@backstage/plugin-auth-backend 0.28.1-next.2 → 0.29.1-next.0

package/CHANGELOG.md

@@ -1,5 +1,67 @@
 # @backstage/plugin-auth-backend
 
+## 0.29.1-next.0
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/plugin-auth-node@0.7.2-next.0
+  - @backstage/plugin-catalog-node@2.2.2-next.0
+  - @backstage/backend-plugin-api@1.9.2-next.0
+
+## 0.29.0
+
+### Minor Changes
+
+- 29d398b: **BREAKING**: Hardened the default allowed patterns for CIMD and DCR to replace the previous permissive `['*']` wildcards with specific defaults for known MCP clients. If you previously relied on the default `['*']` patterns, you will need to explicitly configure the patterns you need in your `app-config.yaml`.
+
+  **CIMD (`experimentalClientIdMetadataDocuments`):**
+
+  - `allowedClientIdPatterns` now defaults to Claude, VS Code, and the built-in Backstage CLI instead of `['*']`
+  - `allowedRedirectUriPatterns` now defaults to loopback addresses (localhost, 127.0.0.1, [::1]) instead of `['*']`
+
+  **DCR (`experimentalDynamicClientRegistration`):**
+
+  - `allowedRedirectUriPatterns` now defaults to Cursor and loopback addresses instead of `['*']`
+
+  If you need to allow additional clients or redirect URIs, you can override these defaults in your `app-config.yaml`:
+
+  ```yaml
+  auth:
+    experimentalClientIdMetadataDocuments:
+      enabled: true
+      allowedClientIdPatterns:
+        - 'https://claude.ai/*'
+        - 'https://vscode.dev/*'
+        - 'https://my-custom-client.example.com/*'
+      allowedRedirectUriPatterns:
+        - 'http://localhost:*'
+        - 'http://127.0.0.1:*'
+        - 'https://my-app.example.com/callback'
+    experimentalDynamicClientRegistration:
+      enabled: true
+      allowedRedirectUriPatterns:
+        - 'cursor://*'
+        - 'http://localhost:*'
+        - 'http://127.0.0.1:*'
+        - 'myapp://*'
+  ```
+
+### Patch Changes
+
+- 9f269d7: Limit the size of fetched client ID metadata documents to prevent oversized responses from being accepted.
+- 3f5e7ec: Improved OIDC error messages to include the rejected redirect URI or client ID, making it easier to debug client registration failures.
+- e9b78e9: Removed the `uuid` dependency and replaced usage with the built-in `crypto.randomUUID()`.
+- 27f24a9: Refresh token usage now verifies that the user's catalog entity still exists before issuing a new access token. If the user has been removed from the catalog, the refresh is rejected and the session is revoked. Transient catalog errors reject the refresh but preserve the session for retry. This check can be disabled by setting `auth.experimentalRefreshToken.dangerouslyDisableCatalogPresenceCheck` to `true`.
+- 4f62755: Improved the OAuth consent dialog for MCP authorization by showing more client details, including the client metadata host for CIMD clients, the metadata URL, callback URL, and requested scopes.
+- Updated dependencies
+  - @backstage/catalog-model@1.9.0
+  - @backstage/errors@1.3.1
+  - @backstage/backend-plugin-api@1.9.1
+  - @backstage/plugin-catalog-node@2.2.1
+  - @backstage/plugin-auth-node@0.7.1
+  - @backstage/config@1.3.8
+
 ## 0.28.1-next.2
 
 ### Patch Changes

package/config.d.ts

@@ -133,6 +133,17 @@ export interface Config {
        * @visibility backend
        */
       maxTokensPerUser?: number;
+      /**
+       * Disables the check that verifies the user's catalog entity still
+       * exists when refreshing a token. This is an escape hatch for
+       * Backstage instances that allow sign-in without a corresponding
+       * catalog user entity. Without the check, refresh tokens for
+       * removed or offboarded users remain valid until they naturally
+       * expire.
+       * @default false
+       * @visibility backend
+       */
+      dangerouslyDisableCatalogPresenceCheck?: boolean;
     };
 
     /**
@@ -152,7 +163,8 @@ export interface Config {
 
       /**
        * A list of allowed URI patterns to use for redirect URIs during
-       * dynamic client registration. Defaults to '[*]' which allows any redirect URI.
+       * dynamic client registration.
+       * Defaults to Cursor and loopback addresses (localhost, 127.0.0.1, [::1]).
        */
       allowedRedirectUriPatterns?: string[];
     };
@@ -172,7 +184,8 @@ export interface Config {
       /**
        * A list of allowed URI patterns for client_id URLs.
        * Uses glob-style pattern matching where `*` matches any characters.
-       * Defaults to ['*'] which allows any client_id URL.
+       * Defaults to `['https://claude.ai/*', 'https://vscode.dev/*', '{baseUrl}/.well-known/oauth-client/cli.json']`
+       * where `{baseUrl}` is the auth backend's base URL.
        *
        * @example ['https://example.com/*', 'https://*.trusted-domain.com/*']
        */
@@ -181,7 +194,7 @@ export interface Config {
       /**
        * A list of allowed URI patterns for redirect URIs.
        * Uses glob-style pattern matching where `*` matches any characters.
-       * Defaults to ['*'] which allows any redirect URI.
+       * Defaults to loopback addresses (localhost, 127.0.0.1, [::1]).
        *
        * @example ['http://localhost:*', 'http://127.0.0.1:*\/callback']
        */

package/dist/authPlugin.cjs.js

@@ -65,7 +65,9 @@ const authPlugin = backendPluginApi.createBackendPlugin({
           config,
           database,
           logger,
-          lifecycle
+          lifecycle,
+          catalog,
+          auth
         }) : void 0;
         const router$1 = await router.createRouter({
           logger,

package/dist/authPlugin.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"authPlugin.cjs.js","sources":["../src/authPlugin.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  coreServices,\n  createBackendPlugin,\n} from '@backstage/backend-plugin-api';\nimport {\n  authOwnershipResolutionExtensionPoint,\n  AuthOwnershipResolver,\n  AuthProviderFactory,\n  authProvidersExtensionPoint,\n} from '@backstage/plugin-auth-node';\nimport { actionsRegistryServiceRef } from '@backstage/backend-plugin-api/alpha';\nimport { catalogServiceRef } from '@backstage/plugin-catalog-node';\nimport { createAuthActions } from './actions';\nimport { createRouter } from './service/router';\nimport { OfflineAccessService } from './service/OfflineAccessService';\n\n/**\n * Auth plugin\n *\n * @public\n */\nexport const authPlugin = createBackendPlugin({\n  pluginId: 'auth',\n  register(reg) {\n    const providers = new Map<string, AuthProviderFactory>();\n    let ownershipResolver: AuthOwnershipResolver | undefined = undefined;\n\n    reg.registerExtensionPoint(authProvidersExtensionPoint, {\n      registerProvider({ providerId, factory }) {\n        if (providers.has(providerId)) {\n          throw new Error(\n            `Auth provider '${providerId}' was already registered`,\n          );\n        }\n        providers.set(providerId, factory);\n      },\n    });\n\n    reg.registerExtensionPoint(authOwnershipResolutionExtensionPoint, {\n      setAuthOwnershipResolver(resolver) {\n        if (ownershipResolver) {\n          throw new Error('Auth ownership resolver is already set');\n        }\n        ownershipResolver = resolver;\n      },\n    });\n\n    reg.registerInit({\n      deps: {\n        httpRouter: coreServices.httpRouter,\n        logger: coreServices.logger,\n        config: coreServices.rootConfig,\n        database: coreServices.database,\n        discovery: coreServices.discovery,\n        auth: coreServices.auth,\n        httpAuth: coreServices.httpAuth,\n        lifecycle: coreServices.lifecycle,\n        catalog: catalogServiceRef,\n        actionsRegistry: actionsRegistryServiceRef,\n        userInfo: coreServices.userInfo,\n      },\n      async init({\n        httpRouter,\n        logger,\n        config,\n        database,\n        discovery,\n        auth,\n        httpAuth,\n        lifecycle,\n        catalog,\n        actionsRegistry,\n        userInfo,\n      }) {\n        const refreshTokensEnabled = config.getOptionalBoolean(\n          'auth.experimentalRefreshToken.enabled',\n        );\n\n        const offlineAccess = refreshTokensEnabled\n          ? await OfflineAccessService.create({\n              config,\n              database,\n              logger,\n              lifecycle,\n            })\n          : undefined;\n\n        const router = await createRouter({\n          logger,\n          config,\n          database,\n          discovery,\n          auth,\n          catalog,\n          providerFactories: Object.fromEntries(providers),\n          ownershipResolver,\n          httpAuth,\n          offlineAccess,\n        });\n        httpRouter.addAuthPolicy({\n          path: '/',\n          allow: 'unauthenticated',\n        });\n        httpRouter.use(router);\n\n        createAuthActions({ auth, catalog, userInfo, actionsRegistry });\n      },\n    });\n  },\n});\n"],"names":["createBackendPlugin","authProvidersExtensionPoint","authOwnershipResolutionExtensionPoint","coreServices","catalogServiceRef","actionsRegistryServiceRef","OfflineAccessService","router","createRouter","createAuthActions"],"mappings":";;;;;;;;;;AAqCO,MAAM,aAAaA,oCAAA,CAAoB;AAAA,EAC5C,QAAA,EAAU,MAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,SAAA,uBAAgB,GAAA,EAAiC;AACvD,IAAA,IAAI,iBAAA,GAAuD,MAAA;AAE3D,IAAA,GAAA,CAAI,uBAAuBC,0CAAA,EAA6B;AAAA,MACtD,gBAAA,CAAiB,EAAE,UAAA,EAAY,OAAA,EAAQ,EAAG;AACxC,QAAA,IAAI,SAAA,CAAU,GAAA,CAAI,UAAU,CAAA,EAAG;AAC7B,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,kBAAkB,UAAU,CAAA,wBAAA;AAAA,WAC9B;AAAA,QACF;AACA,QAAA,SAAA,CAAU,GAAA,CAAI,YAAY,OAAO,CAAA;AAAA,MACnC;AAAA,KACD,CAAA;AAED,IAAA,GAAA,CAAI,uBAAuBC,oDAAA,EAAuC;AAAA,MAChE,yBAAyB,QAAA,EAAU;AACjC,QAAA,IAAI,iBAAA,EAAmB;AACrB,UAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,QAC1D;AACA,QAAA,iBAAA,GAAoB,QAAA;AAAA,MACtB;AAAA,KACD,CAAA;AAED,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM;AAAA,QACJ,YAAYC,6BAAA,CAAa,UAAA;AAAA,QACzB,QAAQA,6BAAA,CAAa,MAAA;AAAA,QACrB,QAAQA,6BAAA,CAAa,UAAA;AAAA,QACrB,UAAUA,6BAAA,CAAa,QAAA;AAAA,QACvB,WAAWA,6BAAA,CAAa,SAAA;AAAA,QACxB,MAAMA,6BAAA,CAAa,IAAA;AAAA,QACnB,UAAUA,6BAAA,CAAa,QAAA;AAAA,QACvB,WAAWA,6BAAA,CAAa,SAAA;AAAA,QACxB,OAAA,EAASC,mCAAA;AAAA,QACT,eAAA,EAAiBC,+BAAA;AAAA,QACjB,UAAUF,6BAAA,CAAa;AAAA,OACzB;AAAA,MACA,MAAM,IAAA,CAAK;AAAA,QACT,UAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,SAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAA;AAAA,QACA,SAAA;AAAA,QACA,OAAA;AAAA,QACA,eAAA;AAAA,QACA;AAAA,OACF,EAAG;AACD,QAAA,MAAM,uBAAuB,MAAA,CAAO,kBAAA;AAAA,UAClC;AAAA,SACF;AAEA,QAAA,MAAM,aAAA,GAAgB,oBAAA,GAClB,MAAMG,yCAAA,CAAqB,MAAA,CAAO;AAAA,UAChC,MAAA;AAAA,UACA,QAAA;AAAA,UACA,MAAA;AAAA,UACA;AAAA,SACD,CAAA,GACD,MAAA;AAEJ,QAAA,MAAMC,QAAA,GAAS,MAAMC,mBAAA,CAAa;AAAA,UAChC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,QAAA;AAAA,UACA,SAAA;AAAA,UACA,IAAA;AAAA,UACA,OAAA;AAAA,UACA,iBAAA,EAAmB,MAAA,CAAO,WAAA,CAAY,SAAS,CAAA;AAAA,UAC/C,iBAAA;AAAA,UACA,QAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,UAAA,CAAW,aAAA,CAAc;AAAA,UACvB,IAAA,EAAM,GAAA;AAAA,UACN,KAAA,EAAO;AAAA,SACR,CAAA;AACD,QAAA,UAAA,CAAW,IAAID,QAAM,CAAA;AAErB,QAAAE,uBAAA,CAAkB,EAAE,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,iBAAiB,CAAA;AAAA,MAChE;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;;;"}
+{"version":3,"file":"authPlugin.cjs.js","sources":["../src/authPlugin.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  coreServices,\n  createBackendPlugin,\n} from '@backstage/backend-plugin-api';\nimport {\n  authOwnershipResolutionExtensionPoint,\n  AuthOwnershipResolver,\n  AuthProviderFactory,\n  authProvidersExtensionPoint,\n} from '@backstage/plugin-auth-node';\nimport { actionsRegistryServiceRef } from '@backstage/backend-plugin-api/alpha';\nimport { catalogServiceRef } from '@backstage/plugin-catalog-node';\nimport { createAuthActions } from './actions';\nimport { createRouter } from './service/router';\nimport { OfflineAccessService } from './service/OfflineAccessService';\n\n/**\n * Auth plugin\n *\n * @public\n */\nexport const authPlugin = createBackendPlugin({\n  pluginId: 'auth',\n  register(reg) {\n    const providers = new Map<string, AuthProviderFactory>();\n    let ownershipResolver: AuthOwnershipResolver | undefined = undefined;\n\n    reg.registerExtensionPoint(authProvidersExtensionPoint, {\n      registerProvider({ providerId, factory }) {\n        if (providers.has(providerId)) {\n          throw new Error(\n            `Auth provider '${providerId}' was already registered`,\n          );\n        }\n        providers.set(providerId, factory);\n      },\n    });\n\n    reg.registerExtensionPoint(authOwnershipResolutionExtensionPoint, {\n      setAuthOwnershipResolver(resolver) {\n        if (ownershipResolver) {\n          throw new Error('Auth ownership resolver is already set');\n        }\n        ownershipResolver = resolver;\n      },\n    });\n\n    reg.registerInit({\n      deps: {\n        httpRouter: coreServices.httpRouter,\n        logger: coreServices.logger,\n        config: coreServices.rootConfig,\n        database: coreServices.database,\n        discovery: coreServices.discovery,\n        auth: coreServices.auth,\n        httpAuth: coreServices.httpAuth,\n        lifecycle: coreServices.lifecycle,\n        catalog: catalogServiceRef,\n        actionsRegistry: actionsRegistryServiceRef,\n        userInfo: coreServices.userInfo,\n      },\n      async init({\n        httpRouter,\n        logger,\n        config,\n        database,\n        discovery,\n        auth,\n        httpAuth,\n        lifecycle,\n        catalog,\n        actionsRegistry,\n        userInfo,\n      }) {\n        const refreshTokensEnabled = config.getOptionalBoolean(\n          'auth.experimentalRefreshToken.enabled',\n        );\n\n        const offlineAccess = refreshTokensEnabled\n          ? await OfflineAccessService.create({\n              config,\n              database,\n              logger,\n              lifecycle,\n              catalog,\n              auth,\n            })\n          : undefined;\n\n        const router = await createRouter({\n          logger,\n          config,\n          database,\n          discovery,\n          auth,\n          catalog,\n          providerFactories: Object.fromEntries(providers),\n          ownershipResolver,\n          httpAuth,\n          offlineAccess,\n        });\n        httpRouter.addAuthPolicy({\n          path: '/',\n          allow: 'unauthenticated',\n        });\n        httpRouter.use(router);\n\n        createAuthActions({ auth, catalog, userInfo, actionsRegistry });\n      },\n    });\n  },\n});\n"],"names":["createBackendPlugin","authProvidersExtensionPoint","authOwnershipResolutionExtensionPoint","coreServices","catalogServiceRef","actionsRegistryServiceRef","OfflineAccessService","router","createRouter","createAuthActions"],"mappings":";;;;;;;;;;AAqCO,MAAM,aAAaA,oCAAA,CAAoB;AAAA,EAC5C,QAAA,EAAU,MAAA;AAAA,EACV,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,SAAA,uBAAgB,GAAA,EAAiC;AACvD,IAAA,IAAI,iBAAA,GAAuD,MAAA;AAE3D,IAAA,GAAA,CAAI,uBAAuBC,0CAAA,EAA6B;AAAA,MACtD,gBAAA,CAAiB,EAAE,UAAA,EAAY,OAAA,EAAQ,EAAG;AACxC,QAAA,IAAI,SAAA,CAAU,GAAA,CAAI,UAAU,CAAA,EAAG;AAC7B,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,kBAAkB,UAAU,CAAA,wBAAA;AAAA,WAC9B;AAAA,QACF;AACA,QAAA,SAAA,CAAU,GAAA,CAAI,YAAY,OAAO,CAAA;AAAA,MACnC;AAAA,KACD,CAAA;AAED,IAAA,GAAA,CAAI,uBAAuBC,oDAAA,EAAuC;AAAA,MAChE,yBAAyB,QAAA,EAAU;AACjC,QAAA,IAAI,iBAAA,EAAmB;AACrB,UAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,QAC1D;AACA,QAAA,iBAAA,GAAoB,QAAA;AAAA,MACtB;AAAA,KACD,CAAA;AAED,IAAA,GAAA,CAAI,YAAA,CAAa;AAAA,MACf,IAAA,EAAM;AAAA,QACJ,YAAYC,6BAAA,CAAa,UAAA;AAAA,QACzB,QAAQA,6BAAA,CAAa,MAAA;AAAA,QACrB,QAAQA,6BAAA,CAAa,UAAA;AAAA,QACrB,UAAUA,6BAAA,CAAa,QAAA;AAAA,QACvB,WAAWA,6BAAA,CAAa,SAAA;AAAA,QACxB,MAAMA,6BAAA,CAAa,IAAA;AAAA,QACnB,UAAUA,6BAAA,CAAa,QAAA;AAAA,QACvB,WAAWA,6BAAA,CAAa,SAAA;AAAA,QACxB,OAAA,EAASC,mCAAA;AAAA,QACT,eAAA,EAAiBC,+BAAA;AAAA,QACjB,UAAUF,6BAAA,CAAa;AAAA,OACzB;AAAA,MACA,MAAM,IAAA,CAAK;AAAA,QACT,UAAA;AAAA,QACA,MAAA;AAAA,QACA,MAAA;AAAA,QACA,QAAA;AAAA,QACA,SAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAA;AAAA,QACA,SAAA;AAAA,QACA,OAAA;AAAA,QACA,eAAA;AAAA,QACA;AAAA,OACF,EAAG;AACD,QAAA,MAAM,uBAAuB,MAAA,CAAO,kBAAA;AAAA,UAClC;AAAA,SACF;AAEA,QAAA,MAAM,aAAA,GAAgB,oBAAA,GAClB,MAAMG,yCAAA,CAAqB,MAAA,CAAO;AAAA,UAChC,MAAA;AAAA,UACA,QAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAA;AAAA,UACA,OAAA;AAAA,UACA;AAAA,SACD,CAAA,GACD,MAAA;AAEJ,QAAA,MAAMC,QAAA,GAAS,MAAMC,mBAAA,CAAa;AAAA,UAChC,MAAA;AAAA,UACA,MAAA;AAAA,UACA,QAAA;AAAA,UACA,SAAA;AAAA,UACA,IAAA;AAAA,UACA,OAAA;AAAA,UACA,iBAAA,EAAmB,MAAA,CAAO,WAAA,CAAY,SAAS,CAAA;AAAA,UAC/C,iBAAA;AAAA,UACA,QAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,UAAA,CAAW,aAAA,CAAc;AAAA,UACvB,IAAA,EAAM,GAAA;AAAA,UACN,KAAA,EAAO;AAAA,SACR,CAAA;AACD,QAAA,UAAA,CAAW,IAAID,QAAM,CAAA;AAErB,QAAAE,uBAAA,CAAkB,EAAE,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,iBAAiB,CAAA;AAAA,MAChE;AAAA,KACD,CAAA;AAAA,EACH;AACF,CAAC;;;;"}

package/dist/service/CimdClient.cjs.js

@@ -88,6 +88,21 @@ function validateMetadata(metadata, expectedClientId) {
     throw new errors.InputError("Client metadata uses forbidden auth method");
   }
 }
+async function readCappedResponseBody(response) {
+  if (!response.body) {
+    return "";
+  }
+  const chunks = [];
+  let received = 0;
+  for await (const chunk of response.body) {
+    received += chunk.byteLength;
+    if (received > MAX_RESPONSE_BYTES) {
+      throw new errors.InputError("Client metadata document too large");
+    }
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
 async function fetchCimdMetadata(opts) {
   const url = opts.validatedUrl ?? validateCimdUrl(opts.clientId);
   const isLocalhostDev = (url.hostname === "localhost" || url.hostname === "127.0.0.1") && process.env.NODE_ENV === "development";
@@ -114,8 +129,12 @@ async function fetchCimdMetadata(opts) {
   }
   let metadata;
   try {
-    metadata = await response.json();
-  } catch {
+    const responseBody = await readCappedResponseBody(response);
+    metadata = JSON.parse(responseBody);
+  } catch (error) {
+    if (errors.isError(error) && error.name === "InputError") {
+      throw error;
+    }
     throw new errors.InputError("Invalid client metadata document");
   }
   validateMetadata(metadata, opts.clientId);

package/dist/service/CimdClient.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"CimdClient.cjs.js","sources":["../../src/service/CimdClient.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { InputError, isError } from '@backstage/errors';\nimport { lookup } from 'node:dns/promises';\nimport ipaddr from 'ipaddr.js';\n\nconst FETCH_TIMEOUT_MS = 10000;\nconst MAX_RESPONSE_BYTES = 64 * 1024;\n\n/** Auth methods that require a client secret - forbidden for CIMD clients */\nconst FORBIDDEN_AUTH_METHODS = [\n  'client_secret_basic',\n  'client_secret_post',\n  'client_secret_jwt',\n];\n\n/**\n * Raw metadata document from a CIMD URL.\n * Note: client_secret fields are included for validation (must NOT be present).\n */\ninterface CimdMetadata {\n  client_id: string;\n  client_name?: string;\n  redirect_uris: string[];\n  response_types?: string[];\n  grant_types?: string[];\n  scope?: string;\n  token_endpoint_auth_method?: string;\n  client_secret?: string;\n  client_secret_expires_at?: number;\n}\n\n/** Validated CIMD client info */\nexport interface CimdClientInfo {\n  clientId: string;\n  clientName: string;\n  redirectUris: string[];\n  responseTypes: string[];\n  grantTypes: string[];\n  scope?: string;\n}\n\n/**\n * Validates and parses a CIMD URL per the IETF draft specification.\n * Requires HTTPS for production, but allows HTTP for localhost (development).\n *\n * @see https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/\n * @throws InputError if the URL is invalid per the CIMD spec\n */\nexport function validateCimdUrl(clientId: string): URL {\n  // Per IETF draft: MUST NOT contain single-dot or double-dot path segments\n  // Check before URL parsing since the URL constructor normalizes these away\n  if (/\\/\\.\\.?(\\/|$)/.test(clientId)) {\n    throw new InputError(\n      'Invalid client_id: path must not contain dot segments',\n    );\n  }\n\n  let url: URL;\n  try {\n    url = new URL(clientId);\n  } catch {\n    throw new InputError('Invalid client_id: not a valid URL');\n  }\n\n  const isHttps = url.protocol === 'https:';\n  const isLocalHttp =\n    url.protocol === 'http:' &&\n    (url.hostname === 'localhost' || url.hostname === '127.0.0.1') &&\n    process.env.NODE_ENV === 'development';\n\n  if (!isHttps && !isLocalHttp) {\n    throw new InputError(\n      'Invalid client_id: must use HTTPS (or HTTP for localhost in development)',\n    );\n  }\n\n  if (url.pathname === '' || url.pathname === '/') {\n    throw new InputError('Invalid client_id: must have a path component');\n  }\n\n  if (url.hash) {\n    throw new InputError('Invalid client_id: must not contain a fragment');\n  }\n\n  if (url.username || url.password) {\n    throw new InputError('Invalid client_id: must not contain credentials');\n  }\n\n  // Per IETF draft: SHOULD NOT include a query string\n  // We reject this for stricter compliance and security\n  if (url.search) {\n    throw new InputError('Invalid client_id: must not contain a query string');\n  }\n\n  return url;\n}\n\n/**\n * SSRF (Server-Side Request Forgery) Protection\n *\n * When fetching CIMD metadata from client-provided URLs, we must prevent\n * attackers from tricking Backstage into accessing internal resources.\n * For example, an attacker could provide a URL that resolves to:\n *   - 127.0.0.1 (localhost services)\n *   - 10.x.x.x, 172.16-31.x.x, 192.168.x.x (internal network)\n *   - Cloud metadata endpoints (169.254.169.254)\n *\n * We use ipaddr.js to check if resolved IPs are in non-public ranges.\n * Only 'unicast' (public internet) addresses are allowed.\n *\n * @see https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/\n *      Section 5.1 - Security Considerations\n */\nfunction isNonPublicIp(ip: string): boolean {\n  try {\n    const addr = ipaddr.parse(ip);\n    const range = addr.range();\n    // Only allow public unicast addresses\n    return range !== 'unicast';\n  } catch {\n    // If we can't parse the IP, treat it as non-public and block it\n    return true;\n  }\n}\n\nasync function validateHostNotPrivate(hostname: string): Promise<void> {\n  try {\n    const addresses = await lookup(hostname, { all: true });\n    const nonPublicAddr = addresses.find(addr => isNonPublicIp(addr.address));\n    if (nonPublicAddr) {\n      throw new InputError('Invalid client_id URL');\n    }\n  } catch (error) {\n    if (isError(error) && error.name === 'InputError') throw error;\n    throw new InputError('Failed to fetch client metadata');\n  }\n}\n\nfunction validateMetadata(\n  metadata: CimdMetadata,\n  expectedClientId: string,\n): void {\n  if (metadata.client_id !== expectedClientId) {\n    throw new InputError('Client ID mismatch in metadata document');\n  }\n\n  if (\n    !Array.isArray(metadata.redirect_uris) ||\n    metadata.redirect_uris.length === 0\n  ) {\n    throw new InputError('Metadata must include at least one redirect_uri');\n  }\n\n  for (const uri of metadata.redirect_uris) {\n    if (!URL.canParse(uri)) {\n      throw new InputError(`Invalid redirect_uri in metadata: ${uri}`);\n    }\n  }\n\n  if (\n    metadata.client_secret !== undefined ||\n    metadata.client_secret_expires_at !== undefined\n  ) {\n    throw new InputError('Client metadata must not contain client_secret');\n  }\n\n  if (\n    metadata.token_endpoint_auth_method &&\n    FORBIDDEN_AUTH_METHODS.includes(metadata.token_endpoint_auth_method)\n  ) {\n    throw new InputError('Client metadata uses forbidden auth method');\n  }\n}\n\n/**\n * Fetches and validates a CIMD metadata document.\n * @throws InputError if fetching or validation fails\n */\nexport async function fetchCimdMetadata(opts: {\n  clientId: string;\n  validatedUrl?: URL;\n}): Promise<CimdClientInfo> {\n  const url = opts.validatedUrl ?? validateCimdUrl(opts.clientId);\n\n  // Skip SSRF validation for localhost in development only\n  const isLocalhostDev =\n    (url.hostname === 'localhost' || url.hostname === '127.0.0.1') &&\n    process.env.NODE_ENV === 'development';\n  if (!isLocalhostDev) {\n    await validateHostNotPrivate(url.hostname);\n  }\n\n  let response: Response;\n  try {\n    response = await fetch(url.toString(), {\n      method: 'GET',\n      headers: { Accept: 'application/json' },\n      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),\n      redirect: 'error',\n    });\n  } catch {\n    throw new InputError('Failed to fetch client metadata');\n  }\n\n  if (!response.ok) {\n    throw new InputError('Failed to fetch client metadata');\n  }\n\n  const contentLength = Number(response.headers.get('content-length'));\n  if (contentLength > MAX_RESPONSE_BYTES) {\n    throw new InputError('Client metadata document too large');\n  }\n\n  let metadata: CimdMetadata;\n  try {\n    metadata = await response.json();\n  } catch {\n    throw new InputError('Invalid client metadata document');\n  }\n\n  validateMetadata(metadata, opts.clientId);\n\n  return {\n    clientId: metadata.client_id,\n    clientName: metadata.client_name || metadata.client_id,\n    redirectUris: metadata.redirect_uris,\n    responseTypes: metadata.response_types || ['code'],\n    grantTypes: metadata.grant_types || ['authorization_code'],\n    scope: metadata.scope,\n  };\n}\n"],"names":["InputError","ipaddr","lookup","isError"],"mappings":";;;;;;;;;;AAoBA,MAAM,gBAAA,GAAmB,GAAA;AACzB,MAAM,qBAAqB,EAAA,GAAK,IAAA;AAGhC,MAAM,sBAAA,GAAyB;AAAA,EAC7B,qBAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF,CAAA;AAmCO,SAAS,gBAAgB,QAAA,EAAuB;AAGrD,EAAA,IAAI,eAAA,CAAgB,IAAA,CAAK,QAAQ,CAAA,EAAG;AAClC,IAAA,MAAM,IAAIA,iBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,QAAQ,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAIA,kBAAW,oCAAoC,CAAA;AAAA,EAC3D;AAEA,EAAA,MAAM,OAAA,GAAU,IAAI,QAAA,KAAa,QAAA;AACjC,EAAA,MAAM,WAAA,GACJ,GAAA,CAAI,QAAA,KAAa,OAAA,KAChB,GAAA,CAAI,QAAA,KAAa,WAAA,IAAe,GAAA,CAAI,QAAA,KAAa,WAAA,CAAA,IAClD,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,aAAA;AAE3B,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,WAAA,EAAa;AAC5B,IAAA,MAAM,IAAIA,iBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,EAAA,IAAM,GAAA,CAAI,aAAa,GAAA,EAAK;AAC/C,IAAA,MAAM,IAAIA,kBAAW,+CAA+C,CAAA;AAAA,EACtE;AAEA,EAAA,IAAI,IAAI,IAAA,EAAM;AACZ,IAAA,MAAM,IAAIA,kBAAW,gDAAgD,CAAA;AAAA,EACvE;AAEA,EAAA,IAAI,GAAA,CAAI,QAAA,IAAY,GAAA,CAAI,QAAA,EAAU;AAChC,IAAA,MAAM,IAAIA,kBAAW,iDAAiD,CAAA;AAAA,EACxE;AAIA,EAAA,IAAI,IAAI,MAAA,EAAQ;AACd,IAAA,MAAM,IAAIA,kBAAW,oDAAoD,CAAA;AAAA,EAC3E;AAEA,EAAA,OAAO,GAAA;AACT;AAkBA,SAAS,cAAc,EAAA,EAAqB;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAOC,uBAAA,CAAO,KAAA,CAAM,EAAE,CAAA;AAC5B,IAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,EAAM;AAEzB,IAAA,OAAO,KAAA,KAAU,SAAA;AAAA,EACnB,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,eAAe,uBAAuB,QAAA,EAAiC;AACrE,EAAA,IAAI;AACF,IAAA,MAAM,YAAY,MAAMC,eAAA,CAAO,UAAU,EAAE,GAAA,EAAK,MAAM,CAAA;AACtD,IAAA,MAAM,gBAAgB,SAAA,CAAU,IAAA,CAAK,UAAQ,aAAA,CAAc,IAAA,CAAK,OAAO,CAAC,CAAA;AACxE,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,MAAM,IAAIF,kBAAW,uBAAuB,CAAA;AAAA,IAC9C;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,IAAIG,eAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,IAAA,KAAS,cAAc,MAAM,KAAA;AACzD,IAAA,MAAM,IAAIH,kBAAW,iCAAiC,CAAA;AAAA,EACxD;AACF;AAEA,SAAS,gBAAA,CACP,UACA,gBAAA,EACM;AACN,EAAA,IAAI,QAAA,CAAS,cAAc,gBAAA,EAAkB;AAC3C,IAAA,MAAM,IAAIA,kBAAW,yCAAyC,CAAA;AAAA,EAChE;AAEA,EAAA,IACE,CAAC,MAAM,OAAA,CAAQ,QAAA,CAAS,aAAa,CAAA,IACrC,QAAA,CAAS,aAAA,CAAc,MAAA,KAAW,CAAA,EAClC;AACA,IAAA,MAAM,IAAIA,kBAAW,iDAAiD,CAAA;AAAA,EACxE;AAEA,EAAA,KAAA,MAAW,GAAA,IAAO,SAAS,aAAA,EAAe;AACxC,IAAA,IAAI,CAAC,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,EAAG;AACtB,MAAA,MAAM,IAAIA,iBAAA,CAAW,CAAA,kCAAA,EAAqC,GAAG,CAAA,CAAE,CAAA;AAAA,IACjE;AAAA,EACF;AAEA,EAAA,IACE,QAAA,CAAS,aAAA,KAAkB,MAAA,IAC3B,QAAA,CAAS,6BAA6B,MAAA,EACtC;AACA,IAAA,MAAM,IAAIA,kBAAW,gDAAgD,CAAA;AAAA,EACvE;AAEA,EAAA,IACE,SAAS,0BAAA,IACT,sBAAA,CAAuB,QAAA,CAAS,QAAA,CAAS,0BAA0B,CAAA,EACnE;AACA,IAAA,MAAM,IAAIA,kBAAW,4CAA4C,CAAA;AAAA,EACnE;AACF;AAMA,eAAsB,kBAAkB,IAAA,EAGZ;AAC1B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,YAAA,IAAgB,eAAA,CAAgB,KAAK,QAAQ,CAAA;AAG9D,EAAA,MAAM,cAAA,GAAA,CACH,IAAI,QAAA,KAAa,WAAA,IAAe,IAAI,QAAA,KAAa,WAAA,KAClD,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,aAAA;AAC3B,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,MAAM,sBAAA,CAAuB,IAAI,QAAQ,CAAA;AAAA,EAC3C;AAEA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,MACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,gBAAgB,CAAA;AAAA,MAC5C,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAIA,kBAAW,iCAAiC,CAAA;AAAA,EACxD;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAIA,kBAAW,iCAAiC,CAAA;AAAA,EACxD;AAEA,EAAA,MAAM,gBAAgB,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAC,CAAA;AACnE,EAAA,IAAI,gBAAgB,kBAAA,EAAoB;AACtC,IAAA,MAAM,IAAIA,kBAAW,oCAAoC,CAAA;AAAA,EAC3D;AAEA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,SAAS,IAAA,EAAK;AAAA,EACjC,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAIA,kBAAW,kCAAkC,CAAA;AAAA,EACzD;AAEA,EAAA,gBAAA,CAAiB,QAAA,EAAU,KAAK,QAAQ,CAAA;AAExC,EAAA,OAAO;AAAA,IACL,UAAU,QAAA,CAAS,SAAA;AAAA,IACnB,UAAA,EAAY,QAAA,CAAS,WAAA,IAAe,QAAA,CAAS,SAAA;AAAA,IAC7C,cAAc,QAAA,CAAS,aAAA;AAAA,IACvB,aAAA,EAAe,QAAA,CAAS,cAAA,IAAkB,CAAC,MAAM,CAAA;AAAA,IACjD,UAAA,EAAY,QAAA,CAAS,WAAA,IAAe,CAAC,oBAAoB,CAAA;AAAA,IACzD,OAAO,QAAA,CAAS;AAAA,GAClB;AACF;;;;;"}
+{"version":3,"file":"CimdClient.cjs.js","sources":["../../src/service/CimdClient.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { InputError, isError } from '@backstage/errors';\nimport { lookup } from 'node:dns/promises';\nimport ipaddr from 'ipaddr.js';\n\nconst FETCH_TIMEOUT_MS = 10000;\nconst MAX_RESPONSE_BYTES = 64 * 1024;\n\n/** Auth methods that require a client secret - forbidden for CIMD clients */\nconst FORBIDDEN_AUTH_METHODS = [\n  'client_secret_basic',\n  'client_secret_post',\n  'client_secret_jwt',\n];\n\n/**\n * Raw metadata document from a CIMD URL.\n * Note: client_secret fields are included for validation (must NOT be present).\n */\ninterface CimdMetadata {\n  client_id: string;\n  client_name?: string;\n  redirect_uris: string[];\n  response_types?: string[];\n  grant_types?: string[];\n  scope?: string;\n  token_endpoint_auth_method?: string;\n  client_secret?: string;\n  client_secret_expires_at?: number;\n}\n\n/** Validated CIMD client info */\nexport interface CimdClientInfo {\n  clientId: string;\n  clientName: string;\n  redirectUris: string[];\n  responseTypes: string[];\n  grantTypes: string[];\n  scope?: string;\n}\n\n/**\n * Validates and parses a CIMD URL per the IETF draft specification.\n * Requires HTTPS for production, but allows HTTP for localhost (development).\n *\n * @see https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/\n * @throws InputError if the URL is invalid per the CIMD spec\n */\nexport function validateCimdUrl(clientId: string): URL {\n  // Per IETF draft: MUST NOT contain single-dot or double-dot path segments\n  // Check before URL parsing since the URL constructor normalizes these away\n  if (/\\/\\.\\.?(\\/|$)/.test(clientId)) {\n    throw new InputError(\n      'Invalid client_id: path must not contain dot segments',\n    );\n  }\n\n  let url: URL;\n  try {\n    url = new URL(clientId);\n  } catch {\n    throw new InputError('Invalid client_id: not a valid URL');\n  }\n\n  const isHttps = url.protocol === 'https:';\n  const isLocalHttp =\n    url.protocol === 'http:' &&\n    (url.hostname === 'localhost' || url.hostname === '127.0.0.1') &&\n    process.env.NODE_ENV === 'development';\n\n  if (!isHttps && !isLocalHttp) {\n    throw new InputError(\n      'Invalid client_id: must use HTTPS (or HTTP for localhost in development)',\n    );\n  }\n\n  if (url.pathname === '' || url.pathname === '/') {\n    throw new InputError('Invalid client_id: must have a path component');\n  }\n\n  if (url.hash) {\n    throw new InputError('Invalid client_id: must not contain a fragment');\n  }\n\n  if (url.username || url.password) {\n    throw new InputError('Invalid client_id: must not contain credentials');\n  }\n\n  // Per IETF draft: SHOULD NOT include a query string\n  // We reject this for stricter compliance and security\n  if (url.search) {\n    throw new InputError('Invalid client_id: must not contain a query string');\n  }\n\n  return url;\n}\n\n/**\n * SSRF (Server-Side Request Forgery) Protection\n *\n * When fetching CIMD metadata from client-provided URLs, we must prevent\n * attackers from tricking Backstage into accessing internal resources.\n * For example, an attacker could provide a URL that resolves to:\n *   - 127.0.0.1 (localhost services)\n *   - 10.x.x.x, 172.16-31.x.x, 192.168.x.x (internal network)\n *   - Cloud metadata endpoints (169.254.169.254)\n *\n * We use ipaddr.js to check if resolved IPs are in non-public ranges.\n * Only 'unicast' (public internet) addresses are allowed.\n *\n * @see https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/\n *      Section 5.1 - Security Considerations\n */\nfunction isNonPublicIp(ip: string): boolean {\n  try {\n    const addr = ipaddr.parse(ip);\n    const range = addr.range();\n    // Only allow public unicast addresses\n    return range !== 'unicast';\n  } catch {\n    // If we can't parse the IP, treat it as non-public and block it\n    return true;\n  }\n}\n\nasync function validateHostNotPrivate(hostname: string): Promise<void> {\n  try {\n    const addresses = await lookup(hostname, { all: true });\n    const nonPublicAddr = addresses.find(addr => isNonPublicIp(addr.address));\n    if (nonPublicAddr) {\n      throw new InputError('Invalid client_id URL');\n    }\n  } catch (error) {\n    if (isError(error) && error.name === 'InputError') throw error;\n    throw new InputError('Failed to fetch client metadata');\n  }\n}\n\nfunction validateMetadata(\n  metadata: CimdMetadata,\n  expectedClientId: string,\n): void {\n  if (metadata.client_id !== expectedClientId) {\n    throw new InputError('Client ID mismatch in metadata document');\n  }\n\n  if (\n    !Array.isArray(metadata.redirect_uris) ||\n    metadata.redirect_uris.length === 0\n  ) {\n    throw new InputError('Metadata must include at least one redirect_uri');\n  }\n\n  for (const uri of metadata.redirect_uris) {\n    if (!URL.canParse(uri)) {\n      throw new InputError(`Invalid redirect_uri in metadata: ${uri}`);\n    }\n  }\n\n  if (\n    metadata.client_secret !== undefined ||\n    metadata.client_secret_expires_at !== undefined\n  ) {\n    throw new InputError('Client metadata must not contain client_secret');\n  }\n\n  if (\n    metadata.token_endpoint_auth_method &&\n    FORBIDDEN_AUTH_METHODS.includes(metadata.token_endpoint_auth_method)\n  ) {\n    throw new InputError('Client metadata uses forbidden auth method');\n  }\n}\n\nasync function readCappedResponseBody(response: Response): Promise<string> {\n  if (!response.body) {\n    return '';\n  }\n\n  const chunks: Buffer[] = [];\n  let received = 0;\n  for await (const chunk of response.body) {\n    received += chunk.byteLength;\n    if (received > MAX_RESPONSE_BYTES) {\n      throw new InputError('Client metadata document too large');\n    }\n    chunks.push(Buffer.from(chunk));\n  }\n\n  return Buffer.concat(chunks).toString('utf8');\n}\n\n/**\n * Fetches and validates a CIMD metadata document.\n * @throws InputError if fetching or validation fails\n */\nexport async function fetchCimdMetadata(opts: {\n  clientId: string;\n  validatedUrl?: URL;\n}): Promise<CimdClientInfo> {\n  const url = opts.validatedUrl ?? validateCimdUrl(opts.clientId);\n\n  // Skip SSRF validation for localhost in development only\n  const isLocalhostDev =\n    (url.hostname === 'localhost' || url.hostname === '127.0.0.1') &&\n    process.env.NODE_ENV === 'development';\n  if (!isLocalhostDev) {\n    await validateHostNotPrivate(url.hostname);\n  }\n\n  let response: Response;\n  try {\n    response = await fetch(url.toString(), {\n      method: 'GET',\n      headers: { Accept: 'application/json' },\n      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),\n      redirect: 'error',\n    });\n  } catch {\n    throw new InputError('Failed to fetch client metadata');\n  }\n\n  if (!response.ok) {\n    throw new InputError('Failed to fetch client metadata');\n  }\n\n  const contentLength = Number(response.headers.get('content-length'));\n  if (contentLength > MAX_RESPONSE_BYTES) {\n    throw new InputError('Client metadata document too large');\n  }\n\n  let metadata: CimdMetadata;\n  try {\n    const responseBody = await readCappedResponseBody(response);\n    metadata = JSON.parse(responseBody) as CimdMetadata;\n  } catch (error) {\n    if (isError(error) && error.name === 'InputError') {\n      throw error;\n    }\n    throw new InputError('Invalid client metadata document');\n  }\n\n  validateMetadata(metadata, opts.clientId);\n\n  return {\n    clientId: metadata.client_id,\n    clientName: metadata.client_name || metadata.client_id,\n    redirectUris: metadata.redirect_uris,\n    responseTypes: metadata.response_types || ['code'],\n    grantTypes: metadata.grant_types || ['authorization_code'],\n    scope: metadata.scope,\n  };\n}\n"],"names":["InputError","ipaddr","lookup","isError"],"mappings":";;;;;;;;;;AAoBA,MAAM,gBAAA,GAAmB,GAAA;AACzB,MAAM,qBAAqB,EAAA,GAAK,IAAA;AAGhC,MAAM,sBAAA,GAAyB;AAAA,EAC7B,qBAAA;AAAA,EACA,oBAAA;AAAA,EACA;AACF,CAAA;AAmCO,SAAS,gBAAgB,QAAA,EAAuB;AAGrD,EAAA,IAAI,eAAA,CAAgB,IAAA,CAAK,QAAQ,CAAA,EAAG;AAClC,IAAA,MAAM,IAAIA,iBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,QAAQ,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAIA,kBAAW,oCAAoC,CAAA;AAAA,EAC3D;AAEA,EAAA,MAAM,OAAA,GAAU,IAAI,QAAA,KAAa,QAAA;AACjC,EAAA,MAAM,WAAA,GACJ,GAAA,CAAI,QAAA,KAAa,OAAA,KAChB,GAAA,CAAI,QAAA,KAAa,WAAA,IAAe,GAAA,CAAI,QAAA,KAAa,WAAA,CAAA,IAClD,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,aAAA;AAE3B,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,WAAA,EAAa;AAC5B,IAAA,MAAM,IAAIA,iBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,EAAA,IAAM,GAAA,CAAI,aAAa,GAAA,EAAK;AAC/C,IAAA,MAAM,IAAIA,kBAAW,+CAA+C,CAAA;AAAA,EACtE;AAEA,EAAA,IAAI,IAAI,IAAA,EAAM;AACZ,IAAA,MAAM,IAAIA,kBAAW,gDAAgD,CAAA;AAAA,EACvE;AAEA,EAAA,IAAI,GAAA,CAAI,QAAA,IAAY,GAAA,CAAI,QAAA,EAAU;AAChC,IAAA,MAAM,IAAIA,kBAAW,iDAAiD,CAAA;AAAA,EACxE;AAIA,EAAA,IAAI,IAAI,MAAA,EAAQ;AACd,IAAA,MAAM,IAAIA,kBAAW,oDAAoD,CAAA;AAAA,EAC3E;AAEA,EAAA,OAAO,GAAA;AACT;AAkBA,SAAS,cAAc,EAAA,EAAqB;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAOC,uBAAA,CAAO,KAAA,CAAM,EAAE,CAAA;AAC5B,IAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,EAAM;AAEzB,IAAA,OAAO,KAAA,KAAU,SAAA;AAAA,EACnB,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,eAAe,uBAAuB,QAAA,EAAiC;AACrE,EAAA,IAAI;AACF,IAAA,MAAM,YAAY,MAAMC,eAAA,CAAO,UAAU,EAAE,GAAA,EAAK,MAAM,CAAA;AACtD,IAAA,MAAM,gBAAgB,SAAA,CAAU,IAAA,CAAK,UAAQ,aAAA,CAAc,IAAA,CAAK,OAAO,CAAC,CAAA;AACxE,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,MAAM,IAAIF,kBAAW,uBAAuB,CAAA;AAAA,IAC9C;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,IAAIG,eAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,IAAA,KAAS,cAAc,MAAM,KAAA;AACzD,IAAA,MAAM,IAAIH,kBAAW,iCAAiC,CAAA;AAAA,EACxD;AACF;AAEA,SAAS,gBAAA,CACP,UACA,gBAAA,EACM;AACN,EAAA,IAAI,QAAA,CAAS,cAAc,gBAAA,EAAkB;AAC3C,IAAA,MAAM,IAAIA,kBAAW,yCAAyC,CAAA;AAAA,EAChE;AAEA,EAAA,IACE,CAAC,MAAM,OAAA,CAAQ,QAAA,CAAS,aAAa,CAAA,IACrC,QAAA,CAAS,aAAA,CAAc,MAAA,KAAW,CAAA,EAClC;AACA,IAAA,MAAM,IAAIA,kBAAW,iDAAiD,CAAA;AAAA,EACxE;AAEA,EAAA,KAAA,MAAW,GAAA,IAAO,SAAS,aAAA,EAAe;AACxC,IAAA,IAAI,CAAC,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,EAAG;AACtB,MAAA,MAAM,IAAIA,iBAAA,CAAW,CAAA,kCAAA,EAAqC,GAAG,CAAA,CAAE,CAAA;AAAA,IACjE;AAAA,EACF;AAEA,EAAA,IACE,QAAA,CAAS,aAAA,KAAkB,MAAA,IAC3B,QAAA,CAAS,6BAA6B,MAAA,EACtC;AACA,IAAA,MAAM,IAAIA,kBAAW,gDAAgD,CAAA;AAAA,EACvE;AAEA,EAAA,IACE,SAAS,0BAAA,IACT,sBAAA,CAAuB,QAAA,CAAS,QAAA,CAAS,0BAA0B,CAAA,EACnE;AACA,IAAA,MAAM,IAAIA,kBAAW,4CAA4C,CAAA;AAAA,EACnE;AACF;AAEA,eAAe,uBAAuB,QAAA,EAAqC;AACzE,EAAA,IAAI,CAAC,SAAS,IAAA,EAAM;AAClB,IAAA,OAAO,EAAA;AAAA,EACT;AAEA,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,WAAA,MAAiB,KAAA,IAAS,SAAS,IAAA,EAAM;AACvC,IAAA,QAAA,IAAY,KAAA,CAAM,UAAA;AAClB,IAAA,IAAI,WAAW,kBAAA,EAAoB;AACjC,MAAA,MAAM,IAAIA,kBAAW,oCAAoC,CAAA;AAAA,IAC3D;AACA,IAAA,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC,CAAA;AAAA,EAChC;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,CAAE,SAAS,MAAM,CAAA;AAC9C;AAMA,eAAsB,kBAAkB,IAAA,EAGZ;AAC1B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,YAAA,IAAgB,eAAA,CAAgB,KAAK,QAAQ,CAAA;AAG9D,EAAA,MAAM,cAAA,GAAA,CACH,IAAI,QAAA,KAAa,WAAA,IAAe,IAAI,QAAA,KAAa,WAAA,KAClD,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,aAAA;AAC3B,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,MAAM,sBAAA,CAAuB,IAAI,QAAQ,CAAA;AAAA,EAC3C;AAEA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,CAAI,QAAA,EAAS,EAAG;AAAA,MACrC,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,MACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,gBAAgB,CAAA;AAAA,MAC5C,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAIA,kBAAW,iCAAiC,CAAA;AAAA,EACxD;AAEA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAIA,kBAAW,iCAAiC,CAAA;AAAA,EACxD;AAEA,EAAA,MAAM,gBAAgB,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAC,CAAA;AACnE,EAAA,IAAI,gBAAgB,kBAAA,EAAoB;AACtC,IAAA,MAAM,IAAIA,kBAAW,oCAAoC,CAAA;AAAA,EAC3D;AAEA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,GAAe,MAAM,sBAAA,CAAuB,QAAQ,CAAA;AAC1D,IAAA,QAAA,GAAW,IAAA,CAAK,MAAM,YAAY,CAAA;AAAA,EACpC,SAAS,KAAA,EAAO;AACd,IAAA,IAAIG,cAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,SAAS,YAAA,EAAc;AACjD,MAAA,MAAM,KAAA;AAAA,IACR;AACA,IAAA,MAAM,IAAIH,kBAAW,kCAAkC,CAAA;AAAA,EACzD;AAEA,EAAA,gBAAA,CAAiB,QAAA,EAAU,KAAK,QAAQ,CAAA;AAExC,EAAA,OAAO;AAAA,IACL,UAAU,QAAA,CAAS,SAAA;AAAA,IACnB,UAAA,EAAY,QAAA,CAAS,WAAA,IAAe,QAAA,CAAS,SAAA;AAAA,IAC7C,cAAc,QAAA,CAAS,aAAA;AAAA,IACvB,aAAA,EAAe,QAAA,CAAS,cAAA,IAAkB,CAAC,MAAM,CAAA;AAAA,IACjD,UAAA,EAAY,QAAA,CAAS,WAAA,IAAe,CAAC,oBAAoB,CAAA;AAAA,IACzD,OAAO,QAAA,CAAS;AAAA,GAClB;AACF;;;;;"}

package/dist/service/OfflineAccessService.cjs.js

@@ -10,6 +10,9 @@ var refreshToken = require('../lib/refreshToken.cjs.js');
 class OfflineAccessService {
   #offlineSessionDb;
   #logger;
+  #dangerouslyDisableCatalogPresenceCheck;
+  #catalog;
+  #auth;
   static async create(options) {
     const { config: config$1, database, logger, lifecycle } = options;
     const tokenLifetime = config$1.has(
@@ -51,6 +54,9 @@ class OfflineAccessService {
         "auth.experimentalRefreshToken.maxTokensPerUser must be a positive number"
       );
     }
+    const dangerouslyDisableCatalogPresenceCheck = config$1.getOptionalBoolean(
+      "auth.experimentalRefreshToken.dangerouslyDisableCatalogPresenceCheck"
+    ) ?? false;
     const knex = await database.getClient();
     if (knex.client.config.client.includes("sqlite") || knex.client.config.client.includes("better-sqlite")) {
       logger.warn(
@@ -78,11 +84,20 @@ class OfflineAccessService {
     lifecycle.addShutdownHook(() => {
       clearInterval(cleanupInterval);
     });
-    return new OfflineAccessService(offlineSessionDb, logger);
+    return new OfflineAccessService(
+      offlineSessionDb,
+      logger,
+      dangerouslyDisableCatalogPresenceCheck,
+      options.catalog,
+      options.auth
+    );
   }
-  constructor(offlineSessionDb, logger) {
+  constructor(offlineSessionDb, logger, dangerouslyDisableCatalogPresenceCheck, catalog, auth) {
     this.#offlineSessionDb = offlineSessionDb;
     this.#logger = logger;
+    this.#dangerouslyDisableCatalogPresenceCheck = dangerouslyDisableCatalogPresenceCheck;
+    this.#catalog = catalog;
+    this.#auth = auth;
   }
   /**
    * Issue a new refresh token for a user
@@ -131,6 +146,32 @@ class OfflineAccessService {
     if (!isValid) {
       throw new errors.AuthenticationError("Invalid refresh token");
     }
+    if (!this.#dangerouslyDisableCatalogPresenceCheck) {
+      try {
+        const entity = await this.#catalog.getEntityByRef(
+          session.userEntityRef,
+          { credentials: await this.#auth.getOwnServiceCredentials() }
+        );
+        if (!entity) {
+          this.#logger.info(
+            `Rejecting refresh for user ${session.userEntityRef} - catalog entity not found, revoking session ${sessionId}`
+          );
+          await this.#offlineSessionDb.deleteSession(sessionId);
+          throw new errors.AuthenticationError(
+            "User entity no longer exists in the catalog"
+          );
+        }
+      } catch (error) {
+        if (error.name === "AuthenticationError") {
+          throw error;
+        }
+        this.#logger.warn(
+          `Failed to validate catalog user existence for ${session.userEntityRef}, rejecting refresh`,
+          error
+        );
+        throw new errors.AuthenticationError("Unable to validate user existence");
+      }
+    }
     const { token: newRefreshToken, hash: newHash } = await refreshToken.generateRefreshToken(sessionId);
     const rotatedSession = await this.#offlineSessionDb.getAndRotateToken(
       sessionId,

package/dist/service/OfflineAccessService.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"OfflineAccessService.cjs.js","sources":["../../src/service/OfflineAccessService.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  DatabaseService,\n  LifecycleService,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { AuthenticationError } from '@backstage/errors';\nimport { readDurationFromConfig } from '@backstage/config';\nimport { durationToMilliseconds } from '@backstage/types';\nimport { randomUUID as uuid } from 'node:crypto';\nimport { OfflineSessionDatabase } from '../database/OfflineSessionDatabase';\nimport {\n  generateRefreshToken,\n  getRefreshTokenId,\n  verifyRefreshToken,\n} from '../lib/refreshToken';\nimport { TokenIssuer } from '../identity/types';\n\n/**\n * Service for managing offline access (refresh tokens)\n * @internal\n */\nexport class OfflineAccessService {\n  readonly #offlineSessionDb: OfflineSessionDatabase;\n  readonly #logger: LoggerService;\n\n  static async create(options: {\n    config: RootConfigService;\n    database: DatabaseService;\n    logger: LoggerService;\n    lifecycle: LifecycleService;\n  }): Promise<OfflineAccessService> {\n    const { config, database, logger, lifecycle } = options;\n\n    const tokenLifetime = config.has(\n      'auth.experimentalRefreshToken.tokenLifetime',\n    )\n      ? readDurationFromConfig(config, {\n          key: 'auth.experimentalRefreshToken.tokenLifetime',\n        })\n      : { days: 30 };\n\n    const maxRotationLifetime = config.has(\n      'auth.experimentalRefreshToken.maxRotationLifetime',\n    )\n      ? readDurationFromConfig(config, {\n          key: 'auth.experimentalRefreshToken.maxRotationLifetime',\n        })\n      : { years: 1 };\n\n    const tokenLifetimeSeconds = Math.floor(\n      durationToMilliseconds(tokenLifetime) / 1000,\n    );\n    const maxRotationLifetimeSeconds = Math.floor(\n      durationToMilliseconds(maxRotationLifetime) / 1000,\n    );\n\n    if (tokenLifetimeSeconds <= 0) {\n      throw new Error(\n        'auth.experimentalRefreshToken.tokenLifetime must be a positive duration',\n      );\n    }\n    if (maxRotationLifetimeSeconds <= 0) {\n      throw new Error(\n        'auth.experimentalRefreshToken.maxRotationLifetime must be a positive duration',\n      );\n    }\n    if (maxRotationLifetimeSeconds <= tokenLifetimeSeconds) {\n      throw new Error(\n        'auth.experimentalRefreshToken.maxRotationLifetime must be greater than tokenLifetime',\n      );\n    }\n\n    const maxTokensPerUser =\n      config.getOptionalNumber(\n        'auth.experimentalRefreshToken.maxTokensPerUser',\n      ) ?? 20;\n\n    if (maxTokensPerUser <= 0) {\n      throw new Error(\n        'auth.experimentalRefreshToken.maxTokensPerUser must be a positive number',\n      );\n    }\n\n    const knex = await database.getClient();\n\n    if (\n      knex.client.config.client.includes('sqlite') ||\n      knex.client.config.client.includes('better-sqlite')\n    ) {\n      logger.warn(\n        'Refresh tokens are enabled with SQLite, which does not support row-level locking. ' +\n          'Concurrent token rotation may not be fully protected against race conditions. ' +\n          'Use PostgreSQL for production deployments.',\n      );\n    }\n\n    const offlineSessionDb = OfflineSessionDatabase.create({\n      knex,\n      tokenLifetimeSeconds,\n      maxRotationLifetimeSeconds,\n      maxTokensPerUser,\n    });\n\n    const cleanupIntervalMs = 60 * 60 * 1000;\n    const cleanupInterval = setInterval(async () => {\n      try {\n        const deleted = await offlineSessionDb.cleanupExpiredSessions();\n        if (deleted > 0) {\n          logger.info(`Cleaned up ${deleted} expired offline sessions`);\n        }\n      } catch (error) {\n        logger.error('Failed to cleanup expired offline sessions', error);\n      }\n    }, cleanupIntervalMs);\n    cleanupInterval.unref();\n\n    lifecycle.addShutdownHook(() => {\n      clearInterval(cleanupInterval);\n    });\n\n    return new OfflineAccessService(offlineSessionDb, logger);\n  }\n\n  private constructor(\n    offlineSessionDb: OfflineSessionDatabase,\n    logger: LoggerService,\n  ) {\n    this.#offlineSessionDb = offlineSessionDb;\n    this.#logger = logger;\n  }\n\n  /**\n   * Issue a new refresh token for a user\n   */\n  async issueRefreshToken(options: {\n    userEntityRef: string;\n    oidcClientId?: string;\n  }): Promise<string> {\n    const { userEntityRef, oidcClientId } = options;\n\n    const sessionId = uuid();\n    const { token, hash } = await generateRefreshToken(sessionId);\n\n    await this.#offlineSessionDb.createSession({\n      id: sessionId,\n      userEntityRef,\n      oidcClientId,\n      tokenHash: hash,\n    });\n\n    this.#logger.debug(\n      `Issued refresh token for user ${userEntityRef} with session ${sessionId}`,\n    );\n\n    return token;\n  }\n\n  /**\n   * Refresh an access token using a refresh token\n   */\n  async refreshAccessToken(options: {\n    refreshToken: string;\n    tokenIssuer: TokenIssuer;\n    clientId?: string;\n  }): Promise<{ accessToken: string; refreshToken: string }> {\n    const { refreshToken, tokenIssuer, clientId } = options;\n\n    let sessionId: string;\n    try {\n      sessionId = getRefreshTokenId(refreshToken);\n    } catch (error) {\n      this.#logger.debug('Failed to extract refresh token ID', error);\n      throw new AuthenticationError('Invalid refresh token format');\n    }\n\n    const session = await this.#offlineSessionDb.getSessionById(sessionId);\n    if (!session) {\n      throw new AuthenticationError('Invalid refresh token');\n    }\n\n    if (this.#offlineSessionDb.isSessionExpired(session)) {\n      await this.#offlineSessionDb.deleteSession(sessionId);\n      throw new AuthenticationError('Invalid refresh token');\n    }\n\n    if (clientId && session.oidcClientId && clientId !== session.oidcClientId) {\n      throw new AuthenticationError(\n        'Refresh token was not issued to this client',\n      );\n    }\n\n    // Verify the caller actually holds a valid token, not just the session ID\n    const isValid = await verifyRefreshToken(refreshToken, session.tokenHash);\n    if (!isValid) {\n      throw new AuthenticationError('Invalid refresh token');\n    }\n\n    const { token: newRefreshToken, hash: newHash } =\n      await generateRefreshToken(sessionId);\n\n    // Atomically swap the hash so a concurrent request with the same token fails\n    const rotatedSession = await this.#offlineSessionDb.getAndRotateToken(\n      sessionId,\n      session.tokenHash,\n      newHash,\n    );\n\n    if (!rotatedSession) {\n      throw new AuthenticationError('Invalid refresh token');\n    }\n\n    const { token: accessToken } = await tokenIssuer.issueToken({\n      claims: {\n        sub: rotatedSession.userEntityRef,\n      },\n    });\n\n    this.#logger.debug(\n      `Refreshed access token for user ${session.userEntityRef} with session ${sessionId}`,\n    );\n\n    return { accessToken, refreshToken: newRefreshToken };\n  }\n\n  /**\n   * Revoke a refresh token\n   */\n  async revokeRefreshToken(refreshToken: string): Promise<void> {\n    try {\n      const sessionId = getRefreshTokenId(refreshToken);\n      await this.#offlineSessionDb.deleteSession(sessionId);\n      this.#logger.debug(`Revoked refresh token with session ${sessionId}`);\n    } catch (error) {\n      // Ignore errors when revoking - token may already be invalid\n      this.#logger.debug('Failed to revoke refresh token', error);\n    }\n  }\n\n  /**\n   * Revoke all refresh tokens for a user\n   */\n  async revokeRefreshTokensByUserEntityRef(\n    userEntityRef: string,\n  ): Promise<void> {\n    const deletedCount =\n      await this.#offlineSessionDb.deleteSessionsByUserEntityRef(userEntityRef);\n    this.#logger.debug(\n      `Revoked ${deletedCount} refresh tokens for user ${userEntityRef}`,\n    );\n  }\n}\n"],"names":["config","readDurationFromConfig","durationToMilliseconds","OfflineSessionDatabase","uuid","generateRefreshToken","refreshToken","getRefreshTokenId","AuthenticationError","verifyRefreshToken"],"mappings":";;;;;;;;;AAsCO,MAAM,oBAAA,CAAqB;AAAA,EACvB,iBAAA;AAAA,EACA,OAAA;AAAA,EAET,aAAa,OAAO,OAAA,EAKc;AAChC,IAAA,MAAM,UAAEA,QAAA,EAAQ,QAAA,EAAU,MAAA,EAAQ,WAAU,GAAI,OAAA;AAEhD,IAAA,MAAM,gBAAgBA,QAAA,CAAO,GAAA;AAAA,MAC3B;AAAA,KACF,GACIC,8BAAuBD,QAAA,EAAQ;AAAA,MAC7B,GAAA,EAAK;AAAA,KACN,CAAA,GACD,EAAE,IAAA,EAAM,EAAA,EAAG;AAEf,IAAA,MAAM,sBAAsBA,QAAA,CAAO,GAAA;AAAA,MACjC;AAAA,KACF,GACIC,8BAAuBD,QAAA,EAAQ;AAAA,MAC7B,GAAA,EAAK;AAAA,KACN,CAAA,GACD,EAAE,KAAA,EAAO,CAAA,EAAE;AAEf,IAAA,MAAM,uBAAuB,IAAA,CAAK,KAAA;AAAA,MAChCE,4BAAA,CAAuB,aAAa,CAAA,GAAI;AAAA,KAC1C;AACA,IAAA,MAAM,6BAA6B,IAAA,CAAK,KAAA;AAAA,MACtCA,4BAAA,CAAuB,mBAAmB,CAAA,GAAI;AAAA,KAChD;AAEA,IAAA,IAAI,wBAAwB,CAAA,EAAG;AAC7B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,8BAA8B,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,8BAA8B,oBAAA,EAAsB;AACtD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,mBACJF,QAAA,CAAO,iBAAA;AAAA,MACL;AAAA,KACF,IAAK,EAAA;AAEP,IAAA,IAAI,oBAAoB,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,SAAA,EAAU;AAEtC,IAAA,IACE,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAC3C,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,eAAe,CAAA,EAClD;AACA,MAAA,MAAA,CAAO,IAAA;AAAA,QACL;AAAA,OAGF;AAAA,IACF;AAEA,IAAA,MAAM,gBAAA,GAAmBG,8CAAuB,MAAA,CAAO;AAAA,MACrD,IAAA;AAAA,MACA,oBAAA;AAAA,MACA,0BAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,MAAM,iBAAA,GAAoB,KAAK,EAAA,GAAK,GAAA;AACpC,IAAA,MAAM,eAAA,GAAkB,YAAY,YAAY;AAC9C,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,MAAM,gBAAA,CAAiB,sBAAA,EAAuB;AAC9D,QAAA,IAAI,UAAU,CAAA,EAAG;AACf,UAAA,MAAA,CAAO,IAAA,CAAK,CAAA,WAAA,EAAc,OAAO,CAAA,yBAAA,CAA2B,CAAA;AAAA,QAC9D;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,MAAA,CAAO,KAAA,CAAM,8CAA8C,KAAK,CAAA;AAAA,MAClE;AAAA,IACF,GAAG,iBAAiB,CAAA;AACpB,IAAA,eAAA,CAAgB,KAAA,EAAM;AAEtB,IAAA,SAAA,CAAU,gBAAgB,MAAM;AAC9B,MAAA,aAAA,CAAc,eAAe,CAAA;AAAA,IAC/B,CAAC,CAAA;AAED,IAAA,OAAO,IAAI,oBAAA,CAAqB,gBAAA,EAAkB,MAAM,CAAA;AAAA,EAC1D;AAAA,EAEQ,WAAA,CACN,kBACA,MAAA,EACA;AACA,IAAA,IAAA,CAAK,iBAAA,GAAoB,gBAAA;AACzB,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,OAAA,EAGJ;AAClB,IAAA,MAAM,EAAE,aAAA,EAAe,YAAA,EAAa,GAAI,OAAA;AAExC,IAAA,MAAM,YAAYC,iBAAA,EAAK;AACvB,IAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAK,GAAI,MAAMC,kCAAqB,SAAS,CAAA;AAE5D,IAAA,MAAM,IAAA,CAAK,kBAAkB,aAAA,CAAc;AAAA,MACzC,EAAA,EAAI,SAAA;AAAA,MACJ,aAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,IAAA,CAAK,OAAA,CAAQ,KAAA;AAAA,MACX,CAAA,8BAAA,EAAiC,aAAa,CAAA,cAAA,EAAiB,SAAS,CAAA;AAAA,KAC1E;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,OAAA,EAIkC;AACzD,IAAA,MAAM,gBAAEC,cAAA,EAAc,WAAA,EAAa,QAAA,EAAS,GAAI,OAAA;AAEhD,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI;AACF,MAAA,SAAA,GAAYC,+BAAkBD,cAAY,CAAA;AAAA,IAC5C,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,oCAAA,EAAsC,KAAK,CAAA;AAC9D,MAAA,MAAM,IAAIE,2BAAoB,8BAA8B,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,iBAAA,CAAkB,eAAe,SAAS,CAAA;AACrE,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIA,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,IAAI,IAAA,CAAK,iBAAA,CAAkB,gBAAA,CAAiB,OAAO,CAAA,EAAG;AACpD,MAAA,MAAM,IAAA,CAAK,iBAAA,CAAkB,aAAA,CAAc,SAAS,CAAA;AACpD,MAAA,MAAM,IAAIA,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,IAAI,QAAA,IAAY,OAAA,CAAQ,YAAA,IAAgB,QAAA,KAAa,QAAQ,YAAA,EAAc;AACzE,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAGA,IAAA,MAAM,OAAA,GAAU,MAAMC,+BAAA,CAAmBH,cAAA,EAAc,QAAQ,SAAS,CAAA;AACxE,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIE,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,MAAM,EAAE,OAAO,eAAA,EAAiB,IAAA,EAAM,SAAQ,GAC5C,MAAMH,kCAAqB,SAAS,CAAA;AAGtC,IAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,iBAAA,CAAkB,iBAAA;AAAA,MAClD,SAAA;AAAA,MACA,OAAA,CAAQ,SAAA;AAAA,MACR;AAAA,KACF;AAEA,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,MAAM,IAAIG,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,MAAM,EAAE,KAAA,EAAO,WAAA,EAAY,GAAI,MAAM,YAAY,UAAA,CAAW;AAAA,MAC1D,MAAA,EAAQ;AAAA,QACN,KAAK,cAAA,CAAe;AAAA;AACtB,KACD,CAAA;AAED,IAAA,IAAA,CAAK,OAAA,CAAQ,KAAA;AAAA,MACX,CAAA,gCAAA,EAAmC,OAAA,CAAQ,aAAa,CAAA,cAAA,EAAiB,SAAS,CAAA;AAAA,KACpF;AAEA,IAAA,OAAO,EAAE,WAAA,EAAa,YAAA,EAAc,eAAA,EAAgB;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmBF,cAAA,EAAqC;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAYC,+BAAkBD,cAAY,CAAA;AAChD,MAAA,MAAM,IAAA,CAAK,iBAAA,CAAkB,aAAA,CAAc,SAAS,CAAA;AACpD,MAAA,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,CAAA,mCAAA,EAAsC,SAAS,CAAA,CAAE,CAAA;AAAA,IACtE,SAAS,KAAA,EAAO;AAEd,MAAA,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,gCAAA,EAAkC,KAAK,CAAA;AAAA,IAC5D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mCACJ,aAAA,EACe;AACf,IAAA,MAAM,YAAA,GACJ,MAAM,IAAA,CAAK,iBAAA,CAAkB,8BAA8B,aAAa,CAAA;AAC1E,IAAA,IAAA,CAAK,OAAA,CAAQ,KAAA;AAAA,MACX,CAAA,QAAA,EAAW,YAAY,CAAA,yBAAA,EAA4B,aAAa,CAAA;AAAA,KAClE;AAAA,EACF;AACF;;;;"}
+{"version":3,"file":"OfflineAccessService.cjs.js","sources":["../../src/service/OfflineAccessService.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  AuthService,\n  DatabaseService,\n  LifecycleService,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { AuthenticationError } from '@backstage/errors';\nimport { readDurationFromConfig } from '@backstage/config';\nimport { durationToMilliseconds } from '@backstage/types';\nimport { CatalogService } from '@backstage/plugin-catalog-node';\nimport { randomUUID as uuid } from 'node:crypto';\nimport { OfflineSessionDatabase } from '../database/OfflineSessionDatabase';\nimport {\n  generateRefreshToken,\n  getRefreshTokenId,\n  verifyRefreshToken,\n} from '../lib/refreshToken';\nimport { TokenIssuer } from '../identity/types';\n\n/**\n * Service for managing offline access (refresh tokens)\n * @internal\n */\nexport class OfflineAccessService {\n  readonly #offlineSessionDb: OfflineSessionDatabase;\n  readonly #logger: LoggerService;\n  readonly #dangerouslyDisableCatalogPresenceCheck: boolean;\n  readonly #catalog: CatalogService;\n  readonly #auth: AuthService;\n\n  static async create(options: {\n    config: RootConfigService;\n    database: DatabaseService;\n    logger: LoggerService;\n    lifecycle: LifecycleService;\n    catalog: CatalogService;\n    auth: AuthService;\n  }): Promise<OfflineAccessService> {\n    const { config, database, logger, lifecycle } = options;\n\n    const tokenLifetime = config.has(\n      'auth.experimentalRefreshToken.tokenLifetime',\n    )\n      ? readDurationFromConfig(config, {\n          key: 'auth.experimentalRefreshToken.tokenLifetime',\n        })\n      : { days: 30 };\n\n    const maxRotationLifetime = config.has(\n      'auth.experimentalRefreshToken.maxRotationLifetime',\n    )\n      ? readDurationFromConfig(config, {\n          key: 'auth.experimentalRefreshToken.maxRotationLifetime',\n        })\n      : { years: 1 };\n\n    const tokenLifetimeSeconds = Math.floor(\n      durationToMilliseconds(tokenLifetime) / 1000,\n    );\n    const maxRotationLifetimeSeconds = Math.floor(\n      durationToMilliseconds(maxRotationLifetime) / 1000,\n    );\n\n    if (tokenLifetimeSeconds <= 0) {\n      throw new Error(\n        'auth.experimentalRefreshToken.tokenLifetime must be a positive duration',\n      );\n    }\n    if (maxRotationLifetimeSeconds <= 0) {\n      throw new Error(\n        'auth.experimentalRefreshToken.maxRotationLifetime must be a positive duration',\n      );\n    }\n    if (maxRotationLifetimeSeconds <= tokenLifetimeSeconds) {\n      throw new Error(\n        'auth.experimentalRefreshToken.maxRotationLifetime must be greater than tokenLifetime',\n      );\n    }\n\n    const maxTokensPerUser =\n      config.getOptionalNumber(\n        'auth.experimentalRefreshToken.maxTokensPerUser',\n      ) ?? 20;\n\n    if (maxTokensPerUser <= 0) {\n      throw new Error(\n        'auth.experimentalRefreshToken.maxTokensPerUser must be a positive number',\n      );\n    }\n\n    const dangerouslyDisableCatalogPresenceCheck =\n      config.getOptionalBoolean(\n        'auth.experimentalRefreshToken.dangerouslyDisableCatalogPresenceCheck',\n      ) ?? false;\n\n    const knex = await database.getClient();\n\n    if (\n      knex.client.config.client.includes('sqlite') ||\n      knex.client.config.client.includes('better-sqlite')\n    ) {\n      logger.warn(\n        'Refresh tokens are enabled with SQLite, which does not support row-level locking. ' +\n          'Concurrent token rotation may not be fully protected against race conditions. ' +\n          'Use PostgreSQL for production deployments.',\n      );\n    }\n\n    const offlineSessionDb = OfflineSessionDatabase.create({\n      knex,\n      tokenLifetimeSeconds,\n      maxRotationLifetimeSeconds,\n      maxTokensPerUser,\n    });\n\n    const cleanupIntervalMs = 60 * 60 * 1000;\n    const cleanupInterval = setInterval(async () => {\n      try {\n        const deleted = await offlineSessionDb.cleanupExpiredSessions();\n        if (deleted > 0) {\n          logger.info(`Cleaned up ${deleted} expired offline sessions`);\n        }\n      } catch (error) {\n        logger.error('Failed to cleanup expired offline sessions', error);\n      }\n    }, cleanupIntervalMs);\n    cleanupInterval.unref();\n\n    lifecycle.addShutdownHook(() => {\n      clearInterval(cleanupInterval);\n    });\n\n    return new OfflineAccessService(\n      offlineSessionDb,\n      logger,\n      dangerouslyDisableCatalogPresenceCheck,\n      options.catalog,\n      options.auth,\n    );\n  }\n\n  private constructor(\n    offlineSessionDb: OfflineSessionDatabase,\n    logger: LoggerService,\n    dangerouslyDisableCatalogPresenceCheck: boolean,\n    catalog: CatalogService,\n    auth: AuthService,\n  ) {\n    this.#offlineSessionDb = offlineSessionDb;\n    this.#logger = logger;\n    this.#dangerouslyDisableCatalogPresenceCheck =\n      dangerouslyDisableCatalogPresenceCheck;\n    this.#catalog = catalog;\n    this.#auth = auth;\n  }\n\n  /**\n   * Issue a new refresh token for a user\n   */\n  async issueRefreshToken(options: {\n    userEntityRef: string;\n    oidcClientId?: string;\n  }): Promise<string> {\n    const { userEntityRef, oidcClientId } = options;\n\n    const sessionId = uuid();\n    const { token, hash } = await generateRefreshToken(sessionId);\n\n    await this.#offlineSessionDb.createSession({\n      id: sessionId,\n      userEntityRef,\n      oidcClientId,\n      tokenHash: hash,\n    });\n\n    this.#logger.debug(\n      `Issued refresh token for user ${userEntityRef} with session ${sessionId}`,\n    );\n\n    return token;\n  }\n\n  /**\n   * Refresh an access token using a refresh token\n   */\n  async refreshAccessToken(options: {\n    refreshToken: string;\n    tokenIssuer: TokenIssuer;\n    clientId?: string;\n  }): Promise<{ accessToken: string; refreshToken: string }> {\n    const { refreshToken, tokenIssuer, clientId } = options;\n\n    let sessionId: string;\n    try {\n      sessionId = getRefreshTokenId(refreshToken);\n    } catch (error) {\n      this.#logger.debug('Failed to extract refresh token ID', error);\n      throw new AuthenticationError('Invalid refresh token format');\n    }\n\n    const session = await this.#offlineSessionDb.getSessionById(sessionId);\n    if (!session) {\n      throw new AuthenticationError('Invalid refresh token');\n    }\n\n    if (this.#offlineSessionDb.isSessionExpired(session)) {\n      await this.#offlineSessionDb.deleteSession(sessionId);\n      throw new AuthenticationError('Invalid refresh token');\n    }\n\n    if (clientId && session.oidcClientId && clientId !== session.oidcClientId) {\n      throw new AuthenticationError(\n        'Refresh token was not issued to this client',\n      );\n    }\n\n    // Verify the caller actually holds a valid token, not just the session ID\n    const isValid = await verifyRefreshToken(refreshToken, session.tokenHash);\n    if (!isValid) {\n      throw new AuthenticationError('Invalid refresh token');\n    }\n\n    if (!this.#dangerouslyDisableCatalogPresenceCheck) {\n      try {\n        const entity = await this.#catalog.getEntityByRef(\n          session.userEntityRef,\n          { credentials: await this.#auth.getOwnServiceCredentials() },\n        );\n        if (!entity) {\n          this.#logger.info(\n            `Rejecting refresh for user ${session.userEntityRef} - catalog entity not found, revoking session ${sessionId}`,\n          );\n          await this.#offlineSessionDb.deleteSession(sessionId);\n          throw new AuthenticationError(\n            'User entity no longer exists in the catalog',\n          );\n        }\n      } catch (error) {\n        if (error.name === 'AuthenticationError') {\n          throw error;\n        }\n        this.#logger.warn(\n          `Failed to validate catalog user existence for ${session.userEntityRef}, rejecting refresh`,\n          error,\n        );\n        throw new AuthenticationError('Unable to validate user existence');\n      }\n    }\n\n    const { token: newRefreshToken, hash: newHash } =\n      await generateRefreshToken(sessionId);\n\n    // Atomically swap the hash so a concurrent request with the same token fails\n    const rotatedSession = await this.#offlineSessionDb.getAndRotateToken(\n      sessionId,\n      session.tokenHash,\n      newHash,\n    );\n\n    if (!rotatedSession) {\n      throw new AuthenticationError('Invalid refresh token');\n    }\n\n    const { token: accessToken } = await tokenIssuer.issueToken({\n      claims: {\n        sub: rotatedSession.userEntityRef,\n      },\n    });\n\n    this.#logger.debug(\n      `Refreshed access token for user ${session.userEntityRef} with session ${sessionId}`,\n    );\n\n    return { accessToken, refreshToken: newRefreshToken };\n  }\n\n  /**\n   * Revoke a refresh token\n   */\n  async revokeRefreshToken(refreshToken: string): Promise<void> {\n    try {\n      const sessionId = getRefreshTokenId(refreshToken);\n      await this.#offlineSessionDb.deleteSession(sessionId);\n      this.#logger.debug(`Revoked refresh token with session ${sessionId}`);\n    } catch (error) {\n      // Ignore errors when revoking - token may already be invalid\n      this.#logger.debug('Failed to revoke refresh token', error);\n    }\n  }\n\n  /**\n   * Revoke all refresh tokens for a user\n   */\n  async revokeRefreshTokensByUserEntityRef(\n    userEntityRef: string,\n  ): Promise<void> {\n    const deletedCount =\n      await this.#offlineSessionDb.deleteSessionsByUserEntityRef(userEntityRef);\n    this.#logger.debug(\n      `Revoked ${deletedCount} refresh tokens for user ${userEntityRef}`,\n    );\n  }\n}\n"],"names":["config","readDurationFromConfig","durationToMilliseconds","OfflineSessionDatabase","uuid","generateRefreshToken","refreshToken","getRefreshTokenId","AuthenticationError","verifyRefreshToken"],"mappings":";;;;;;;;;AAwCO,MAAM,oBAAA,CAAqB;AAAA,EACvB,iBAAA;AAAA,EACA,OAAA;AAAA,EACA,uCAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EAET,aAAa,OAAO,OAAA,EAOc;AAChC,IAAA,MAAM,UAAEA,QAAA,EAAQ,QAAA,EAAU,MAAA,EAAQ,WAAU,GAAI,OAAA;AAEhD,IAAA,MAAM,gBAAgBA,QAAA,CAAO,GAAA;AAAA,MAC3B;AAAA,KACF,GACIC,8BAAuBD,QAAA,EAAQ;AAAA,MAC7B,GAAA,EAAK;AAAA,KACN,CAAA,GACD,EAAE,IAAA,EAAM,EAAA,EAAG;AAEf,IAAA,MAAM,sBAAsBA,QAAA,CAAO,GAAA;AAAA,MACjC;AAAA,KACF,GACIC,8BAAuBD,QAAA,EAAQ;AAAA,MAC7B,GAAA,EAAK;AAAA,KACN,CAAA,GACD,EAAE,KAAA,EAAO,CAAA,EAAE;AAEf,IAAA,MAAM,uBAAuB,IAAA,CAAK,KAAA;AAAA,MAChCE,4BAAA,CAAuB,aAAa,CAAA,GAAI;AAAA,KAC1C;AACA,IAAA,MAAM,6BAA6B,IAAA,CAAK,KAAA;AAAA,MACtCA,4BAAA,CAAuB,mBAAmB,CAAA,GAAI;AAAA,KAChD;AAEA,IAAA,IAAI,wBAAwB,CAAA,EAAG;AAC7B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,8BAA8B,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,8BAA8B,oBAAA,EAAsB;AACtD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,mBACJF,QAAA,CAAO,iBAAA;AAAA,MACL;AAAA,KACF,IAAK,EAAA;AAEP,IAAA,IAAI,oBAAoB,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,yCACJA,QAAA,CAAO,kBAAA;AAAA,MACL;AAAA,KACF,IAAK,KAAA;AAEP,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,SAAA,EAAU;AAEtC,IAAA,IACE,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAC3C,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,eAAe,CAAA,EAClD;AACA,MAAA,MAAA,CAAO,IAAA;AAAA,QACL;AAAA,OAGF;AAAA,IACF;AAEA,IAAA,MAAM,gBAAA,GAAmBG,8CAAuB,MAAA,CAAO;AAAA,MACrD,IAAA;AAAA,MACA,oBAAA;AAAA,MACA,0BAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,MAAM,iBAAA,GAAoB,KAAK,EAAA,GAAK,GAAA;AACpC,IAAA,MAAM,eAAA,GAAkB,YAAY,YAAY;AAC9C,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,MAAM,gBAAA,CAAiB,sBAAA,EAAuB;AAC9D,QAAA,IAAI,UAAU,CAAA,EAAG;AACf,UAAA,MAAA,CAAO,IAAA,CAAK,CAAA,WAAA,EAAc,OAAO,CAAA,yBAAA,CAA2B,CAAA;AAAA,QAC9D;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,MAAA,CAAO,KAAA,CAAM,8CAA8C,KAAK,CAAA;AAAA,MAClE;AAAA,IACF,GAAG,iBAAiB,CAAA;AACpB,IAAA,eAAA,CAAgB,KAAA,EAAM;AAEtB,IAAA,SAAA,CAAU,gBAAgB,MAAM;AAC9B,MAAA,aAAA,CAAc,eAAe,CAAA;AAAA,IAC/B,CAAC,CAAA;AAED,IAAA,OAAO,IAAI,oBAAA;AAAA,MACT,gBAAA;AAAA,MACA,MAAA;AAAA,MACA,sCAAA;AAAA,MACA,OAAA,CAAQ,OAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACV;AAAA,EACF;AAAA,EAEQ,WAAA,CACN,gBAAA,EACA,MAAA,EACA,sCAAA,EACA,SACA,IAAA,EACA;AACA,IAAA,IAAA,CAAK,iBAAA,GAAoB,gBAAA;AACzB,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AACf,IAAA,IAAA,CAAK,uCAAA,GACH,sCAAA;AACF,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAChB,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkB,OAAA,EAGJ;AAClB,IAAA,MAAM,EAAE,aAAA,EAAe,YAAA,EAAa,GAAI,OAAA;AAExC,IAAA,MAAM,YAAYC,iBAAA,EAAK;AACvB,IAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAK,GAAI,MAAMC,kCAAqB,SAAS,CAAA;AAE5D,IAAA,MAAM,IAAA,CAAK,kBAAkB,aAAA,CAAc;AAAA,MACzC,EAAA,EAAI,SAAA;AAAA,MACJ,aAAA;AAAA,MACA,YAAA;AAAA,MACA,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,IAAA,CAAK,OAAA,CAAQ,KAAA;AAAA,MACX,CAAA,8BAAA,EAAiC,aAAa,CAAA,cAAA,EAAiB,SAAS,CAAA;AAAA,KAC1E;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,OAAA,EAIkC;AACzD,IAAA,MAAM,gBAAEC,cAAA,EAAc,WAAA,EAAa,QAAA,EAAS,GAAI,OAAA;AAEhD,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI;AACF,MAAA,SAAA,GAAYC,+BAAkBD,cAAY,CAAA;AAAA,IAC5C,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,oCAAA,EAAsC,KAAK,CAAA;AAC9D,MAAA,MAAM,IAAIE,2BAAoB,8BAA8B,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,iBAAA,CAAkB,eAAe,SAAS,CAAA;AACrE,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIA,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,IAAI,IAAA,CAAK,iBAAA,CAAkB,gBAAA,CAAiB,OAAO,CAAA,EAAG;AACpD,MAAA,MAAM,IAAA,CAAK,iBAAA,CAAkB,aAAA,CAAc,SAAS,CAAA;AACpD,MAAA,MAAM,IAAIA,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,IAAI,QAAA,IAAY,OAAA,CAAQ,YAAA,IAAgB,QAAA,KAAa,QAAQ,YAAA,EAAc;AACzE,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAGA,IAAA,MAAM,OAAA,GAAU,MAAMC,+BAAA,CAAmBH,cAAA,EAAc,QAAQ,SAAS,CAAA;AACxE,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIE,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,IAAI,CAAC,KAAK,uCAAA,EAAyC;AACjD,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,QAAA,CAAS,cAAA;AAAA,UACjC,OAAA,CAAQ,aAAA;AAAA,UACR,EAAE,WAAA,EAAa,MAAM,IAAA,CAAK,KAAA,CAAM,0BAAyB;AAAE,SAC7D;AACA,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,IAAA,CAAK,OAAA,CAAQ,IAAA;AAAA,YACX,CAAA,2BAAA,EAA8B,OAAA,CAAQ,aAAa,CAAA,8CAAA,EAAiD,SAAS,CAAA;AAAA,WAC/G;AACA,UAAA,MAAM,IAAA,CAAK,iBAAA,CAAkB,aAAA,CAAc,SAAS,CAAA;AACpD,UAAA,MAAM,IAAIA,0BAAA;AAAA,YACR;AAAA,WACF;AAAA,QACF;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,KAAA,CAAM,SAAS,qBAAA,EAAuB;AACxC,UAAA,MAAM,KAAA;AAAA,QACR;AACA,QAAA,IAAA,CAAK,OAAA,CAAQ,IAAA;AAAA,UACX,CAAA,8CAAA,EAAiD,QAAQ,aAAa,CAAA,mBAAA,CAAA;AAAA,UACtE;AAAA,SACF;AACA,QAAA,MAAM,IAAIA,2BAAoB,mCAAmC,CAAA;AAAA,MACnE;AAAA,IACF;AAEA,IAAA,MAAM,EAAE,OAAO,eAAA,EAAiB,IAAA,EAAM,SAAQ,GAC5C,MAAMH,kCAAqB,SAAS,CAAA;AAGtC,IAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,iBAAA,CAAkB,iBAAA;AAAA,MAClD,SAAA;AAAA,MACA,OAAA,CAAQ,SAAA;AAAA,MACR;AAAA,KACF;AAEA,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,MAAM,IAAIG,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,MAAM,EAAE,KAAA,EAAO,WAAA,EAAY,GAAI,MAAM,YAAY,UAAA,CAAW;AAAA,MAC1D,MAAA,EAAQ;AAAA,QACN,KAAK,cAAA,CAAe;AAAA;AACtB,KACD,CAAA;AAED,IAAA,IAAA,CAAK,OAAA,CAAQ,KAAA;AAAA,MACX,CAAA,gCAAA,EAAmC,OAAA,CAAQ,aAAa,CAAA,cAAA,EAAiB,SAAS,CAAA;AAAA,KACpF;AAEA,IAAA,OAAO,EAAE,WAAA,EAAa,YAAA,EAAc,eAAA,EAAgB;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmBF,cAAA,EAAqC;AAC5D,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAYC,+BAAkBD,cAAY,CAAA;AAChD,MAAA,MAAM,IAAA,CAAK,iBAAA,CAAkB,aAAA,CAAc,SAAS,CAAA;AACpD,MAAA,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,CAAA,mCAAA,EAAsC,SAAS,CAAA,CAAE,CAAA;AAAA,IACtE,SAAS,KAAA,EAAO;AAEd,MAAA,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,gCAAA,EAAkC,KAAK,CAAA;AAAA,IAC5D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mCACJ,aAAA,EACe;AACf,IAAA,MAAM,YAAA,GACJ,MAAM,IAAA,CAAK,iBAAA,CAAkB,8BAA8B,aAAa,CAAA;AAC1E,IAAA,IAAA,CAAK,OAAA,CAAQ,KAAA;AAAA,MACX,CAAA,QAAA,EAAW,YAAY,CAAA,yBAAA,EAA4B,aAAa,CAAA;AAAA,KAClE;AAAA,EACF;AACF;;;;"}

package/dist/service/OidcService.cjs.js

@@ -16,10 +16,18 @@ function validateRedirectUri(redirectUri, allowedPatterns) {
   const parsed = new URL(redirectUri);
   const normalized = `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
   if (!allowedPatterns.some((pattern) => matcher__default.default.isMatch(normalized, pattern))) {
-    throw new errors.InputError("Invalid redirect_uri");
+    throw new errors.InputError(`Invalid redirect_uri '${normalized}'`);
   }
 }
 const LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+const LOOPBACK_REDIRECT_PATTERNS = [
+  "http://localhost:*",
+  "http://localhost/*",
+  "http://127.0.0.1:*",
+  "http://127.0.0.1/*",
+  "http://[::1]:*",
+  "http://[::1]/*"
+];
 function matchesRedirectUri(requestUri, registeredUris) {
   const requested = new URL(requestUri);
   if (!LOOPBACK_HOSTS.includes(requested.hostname)) {
@@ -136,7 +144,11 @@ class OidcService {
     const generatedClientSecret = crypto__default.default.randomUUID();
     const allowedRedirectUriPatterns = this.config.getOptionalStringArray(
       "auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns"
-    ) ?? ["*"];
+    ) ?? [
+      "cursor://*",
+      "https://www.cursor.com/*",
+      ...LOOPBACK_REDIRECT_PATTERNS
+    ];
     for (const redirectUri of opts.redirectUris ?? []) {
       validateRedirectUri(redirectUri, allowedRedirectUriPatterns);
     }
@@ -197,16 +209,18 @@ class OidcService {
     };
   }
   getCimdConfig() {
+    const enabled = this.config.getOptionalBoolean(
+      "auth.experimentalClientIdMetadataDocuments.enabled"
+    ) ?? false;
+    const cliClientId = `${this.baseUrl}/.well-known/oauth-client/cli.json`;
     return {
-      enabled: this.config.getOptionalBoolean(
-        "auth.experimentalClientIdMetadataDocuments.enabled"
-      ) ?? false,
+      enabled,
       allowedClientIdPatterns: this.config.getOptionalStringArray(
         "auth.experimentalClientIdMetadataDocuments.allowedClientIdPatterns"
-      ) ?? ["*"],
+      ) ?? ["https://claude.ai/*", "https://vscode.dev/*", cliClientId],
       allowedRedirectUriPatterns: this.config.getOptionalStringArray(
         "auth.experimentalClientIdMetadataDocuments.allowedRedirectUriPatterns"
-      ) ?? ["*"]
+      ) ?? LOOPBACK_REDIRECT_PATTERNS
     };
   }
   async resolveClient(opts) {
@@ -228,7 +242,7 @@ class OidcService {
     if (!cimd.allowedClientIdPatterns.some(
       (pattern) => matcher__default.default.isMatch(opts.clientId, pattern)
     )) {
-      throw new errors.InputError("Invalid client_id");
+      throw new errors.InputError(`Invalid client_id '${opts.clientId}'`);
     }
     const cimdClient = await CimdClient.fetchCimdMetadata({
       clientId: opts.clientId,
@@ -237,7 +251,9 @@ class OidcService {
     if (opts.redirectUri) {
       validateRedirectUri(opts.redirectUri, cimd.allowedRedirectUriPatterns);
       if (!matchesRedirectUri(opts.redirectUri, cimdClient.redirectUris)) {
-        throw new errors.InputError("Redirect URI not registered");
+        throw new errors.InputError(
+          `Invalid redirect_uri '${opts.redirectUri}', not registered in client metadata`
+        );
       }
     }
     return {
@@ -252,7 +268,7 @@ class OidcService {
       throw new errors.InputError("Invalid client_id");
     }
     if (opts.redirectUri && !client.redirectUris.includes(opts.redirectUri)) {
-      throw new errors.InputError("Invalid redirect_uri");
+      throw new errors.InputError(`Invalid redirect_uri '${opts.redirectUri}'`);
     }
     return {
       clientName: client.clientName,

package/dist/service/OidcService.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"OidcService.cjs.js","sources":["../../src/service/OidcService.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  AuthService,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { TokenIssuer } from '../identity/types';\nimport { UserInfoDatabase } from '../database/UserInfoDatabase';\nimport {\n  AuthenticationError,\n  InputError,\n  NotFoundError,\n} from '@backstage/errors';\nimport { decodeJwt } from 'jose';\nimport crypto from 'node:crypto';\nimport { OidcDatabase } from '../database/OidcDatabase';\nimport { DateTime } from 'luxon';\nimport matcher from 'matcher';\nimport { OfflineAccessService } from './OfflineAccessService';\nimport { validateCimdUrl, fetchCimdMetadata } from './CimdClient';\n\nfunction validateRedirectUri(\n  redirectUri: string,\n  allowedPatterns: string[],\n): void {\n  const parsed = new URL(redirectUri);\n  const normalized = `${parsed.protocol}//${parsed.host}${parsed.pathname}`;\n\n  if (!allowedPatterns.some(pattern => matcher.isMatch(normalized, pattern))) {\n    throw new InputError('Invalid redirect_uri');\n  }\n}\n\nconst LOOPBACK_HOSTS = ['localhost', '127.0.0.1', '[::1]'];\n\n/**\n * RFC 8252 Section 7.3: For loopback redirect URIs, the authorization server\n * MUST allow any port to be specified at the time of the request. This matches\n * redirect URIs by scheme, hostname, and path only, ignoring the port.\n */\nfunction matchesRedirectUri(\n  requestUri: string,\n  registeredUris: string[],\n): boolean {\n  const requested = new URL(requestUri);\n\n  if (!LOOPBACK_HOSTS.includes(requested.hostname)) {\n    return registeredUris.includes(requestUri);\n  }\n\n  return registeredUris.some(registered => {\n    let reg: URL;\n    try {\n      reg = new URL(registered);\n    } catch {\n      return false;\n    }\n    return (\n      LOOPBACK_HOSTS.includes(reg.hostname) &&\n      reg.protocol === requested.protocol &&\n      reg.hostname === requested.hostname &&\n      reg.pathname === requested.pathname\n    );\n  });\n}\n\nexport class OidcService {\n  private readonly auth: AuthService;\n  private readonly tokenIssuer: TokenIssuer;\n  private readonly baseUrl: string;\n  private readonly userInfo: UserInfoDatabase;\n  private readonly oidc: OidcDatabase;\n  private readonly config: RootConfigService;\n  private readonly logger: LoggerService;\n  private readonly offlineAccess?: OfflineAccessService;\n\n  private constructor(\n    auth: AuthService,\n    tokenIssuer: TokenIssuer,\n    baseUrl: string,\n    userInfo: UserInfoDatabase,\n    oidc: OidcDatabase,\n    config: RootConfigService,\n    logger: LoggerService,\n    offlineAccess?: OfflineAccessService,\n  ) {\n    this.auth = auth;\n    this.tokenIssuer = tokenIssuer;\n    this.baseUrl = baseUrl;\n    this.userInfo = userInfo;\n    this.oidc = oidc;\n    this.config = config;\n    this.logger = logger;\n    this.offlineAccess = offlineAccess;\n  }\n\n  static create(options: {\n    auth: AuthService;\n    tokenIssuer: TokenIssuer;\n    baseUrl: string;\n    userInfo: UserInfoDatabase;\n    oidc: OidcDatabase;\n    config: RootConfigService;\n    logger: LoggerService;\n    offlineAccess?: OfflineAccessService;\n  }) {\n    return new OidcService(\n      options.auth,\n      options.tokenIssuer,\n      options.baseUrl,\n      options.userInfo,\n      options.oidc,\n      options.config,\n      options.logger,\n      options.offlineAccess,\n    );\n  }\n\n  public getConfiguration() {\n    const dcrEnabled = this.config.getOptionalBoolean(\n      'auth.experimentalDynamicClientRegistration.enabled',\n    );\n    const { enabled: cimdEnabled } = this.getCimdConfig();\n\n    return {\n      issuer: this.baseUrl,\n      token_endpoint: `${this.baseUrl}/v1/token`,\n      userinfo_endpoint: `${this.baseUrl}/v1/userinfo`,\n      jwks_uri: `${this.baseUrl}/.well-known/jwks.json`,\n      response_types_supported: ['code', 'id_token'],\n      subject_types_supported: ['public'],\n      id_token_signing_alg_values_supported: [\n        'RS256',\n        'RS384',\n        'RS512',\n        'ES256',\n        'ES384',\n        'ES512',\n        'PS256',\n        'PS384',\n        'PS512',\n        'EdDSA',\n      ],\n      scopes_supported: [\n        'openid',\n        ...(this.offlineAccess ? ['offline_access'] : []),\n      ],\n      token_endpoint_auth_methods_supported: [\n        'client_secret_basic',\n        'client_secret_post',\n        ...(cimdEnabled ? ['none'] : []),\n      ],\n      claims_supported: ['sub', 'ent'],\n      grant_types_supported: [\n        'authorization_code',\n        ...(this.offlineAccess ? ['refresh_token'] : []),\n      ],\n      authorization_endpoint: `${this.baseUrl}/v1/authorize`,\n      code_challenge_methods_supported: ['S256', 'plain'],\n      ...(dcrEnabled && {\n        registration_endpoint: `${this.baseUrl}/v1/register`,\n        revocation_endpoint: `${this.baseUrl}/v1/revoke`,\n      }),\n      ...(cimdEnabled && { client_id_metadata_document_supported: true }),\n    };\n  }\n\n  public async listPublicKeys() {\n    return await this.tokenIssuer.listPublicKeys();\n  }\n\n  public async getUserInfo({ token }: { token: string }) {\n    const credentials = await this.auth.authenticate(token, {\n      allowLimitedAccess: true,\n    });\n    if (!this.auth.isPrincipal(credentials, 'user')) {\n      throw new InputError(\n        'Userinfo endpoint must be called with a token that represents a user principal',\n      );\n    }\n\n    const { sub: userEntityRef } = decodeJwt(token);\n\n    if (typeof userEntityRef !== 'string') {\n      throw new Error('Invalid user token, user entity ref must be a string');\n    }\n    return await this.userInfo.getUserInfo(userEntityRef);\n  }\n\n  public async registerClient(opts: {\n    responseTypes?: string[];\n    grantTypes?: string[];\n    clientName: string;\n    redirectUris?: string[];\n    scope?: string;\n  }) {\n    const generatedClientId = crypto.randomUUID();\n    const generatedClientSecret = crypto.randomUUID();\n\n    const allowedRedirectUriPatterns = this.config.getOptionalStringArray(\n      'auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns',\n    ) ?? ['*'];\n\n    for (const redirectUri of opts.redirectUris ?? []) {\n      validateRedirectUri(redirectUri, allowedRedirectUriPatterns);\n    }\n\n    return await this.oidc.createClient({\n      clientId: generatedClientId,\n      clientName: opts.clientName,\n      clientSecret: generatedClientSecret,\n      redirectUris: opts.redirectUris ?? [],\n      responseTypes: opts.responseTypes ?? ['code'],\n      grantTypes: opts.grantTypes ?? ['authorization_code'],\n      scope: opts.scope,\n    });\n  }\n\n  public async createAuthorizationSession(opts: {\n    clientId: string;\n    redirectUri: string;\n    responseType: string;\n    scope?: string;\n    state?: string;\n    nonce?: string;\n    codeChallenge?: string;\n    codeChallengeMethod?: string;\n  }) {\n    const {\n      clientId,\n      redirectUri,\n      responseType,\n      scope,\n      state,\n      nonce,\n      codeChallenge,\n      codeChallengeMethod,\n    } = opts;\n\n    if (responseType !== 'code') {\n      throw new InputError('Only authorization code flow is supported');\n    }\n\n    const client = await this.resolveClient({ clientId, redirectUri });\n\n    if (client.requiresPkce && !codeChallenge) {\n      throw new InputError(\n        'PKCE is required for public clients. Provide a code_challenge parameter.',\n      );\n    }\n\n    if (codeChallenge) {\n      if (\n        !codeChallengeMethod ||\n        !['S256', 'plain'].includes(codeChallengeMethod)\n      ) {\n        throw new InputError('Invalid code_challenge_method');\n      }\n    }\n\n    const sessionId = crypto.randomUUID();\n    const sessionExpiresAt = DateTime.now().plus({ hours: 1 }).toJSDate();\n\n    await this.oidc.createAuthorizationSession({\n      id: sessionId,\n      clientId,\n      redirectUri,\n      responseType,\n      scope,\n      state,\n      codeChallenge,\n      codeChallengeMethod,\n      nonce,\n      expiresAt: sessionExpiresAt,\n    });\n\n    return {\n      id: sessionId,\n      clientName: client.clientName,\n      scope,\n      redirectUri,\n    };\n  }\n\n  private getCimdConfig() {\n    return {\n      enabled:\n        this.config.getOptionalBoolean(\n          'auth.experimentalClientIdMetadataDocuments.enabled',\n        ) ?? false,\n      allowedClientIdPatterns: this.config.getOptionalStringArray(\n        'auth.experimentalClientIdMetadataDocuments.allowedClientIdPatterns',\n      ) ?? ['*'],\n      allowedRedirectUriPatterns: this.config.getOptionalStringArray(\n        'auth.experimentalClientIdMetadataDocuments.allowedRedirectUriPatterns',\n      ) ?? ['*'],\n    };\n  }\n\n  private async resolveClient(opts: {\n    clientId: string;\n    redirectUri?: string;\n  }) {\n    let cimdUrl: URL | undefined;\n    try {\n      cimdUrl = validateCimdUrl(opts.clientId);\n    } catch {\n      // Not a valid CIMD URL, fall through to DCR\n    }\n\n    if (cimdUrl) {\n      return this.resolveCimdClient({ ...opts, cimdUrl });\n    }\n    return this.resolveDcrClient(opts);\n  }\n\n  private async resolveCimdClient(opts: {\n    clientId: string;\n    cimdUrl: URL;\n    redirectUri?: string;\n  }) {\n    const cimd = this.getCimdConfig();\n\n    if (!cimd.enabled) {\n      throw new InputError('Client ID metadata documents not enabled');\n    }\n\n    if (\n      !cimd.allowedClientIdPatterns.some(pattern =>\n        matcher.isMatch(opts.clientId, pattern),\n      )\n    ) {\n      throw new InputError('Invalid client_id');\n    }\n\n    const cimdClient = await fetchCimdMetadata({\n      clientId: opts.clientId,\n      validatedUrl: opts.cimdUrl,\n    });\n\n    if (opts.redirectUri) {\n      validateRedirectUri(opts.redirectUri, cimd.allowedRedirectUriPatterns);\n\n      if (!matchesRedirectUri(opts.redirectUri, cimdClient.redirectUris)) {\n        throw new InputError('Redirect URI not registered');\n      }\n    }\n\n    return {\n      clientName: cimdClient.clientName,\n      redirectUris: cimdClient.redirectUris,\n      requiresPkce: true,\n    };\n  }\n\n  private async resolveDcrClient(opts: {\n    clientId: string;\n    redirectUri?: string;\n  }) {\n    const client = await this.oidc.getClient({ clientId: opts.clientId });\n    if (!client) {\n      throw new InputError('Invalid client_id');\n    }\n\n    if (opts.redirectUri && !client.redirectUris.includes(opts.redirectUri)) {\n      throw new InputError('Invalid redirect_uri');\n    }\n\n    return {\n      clientName: client.clientName,\n      redirectUris: client.redirectUris,\n      requiresPkce: false,\n    };\n  }\n\n  private async getValidPendingSession(sessionId: string) {\n    const session = await this.oidc.getAuthorizationSession({ id: sessionId });\n\n    if (!session) {\n      throw new NotFoundError('Invalid authorization session');\n    }\n\n    if (DateTime.fromJSDate(session.expiresAt) < DateTime.now()) {\n      throw new InputError('Authorization session expired');\n    }\n\n    if (session.status !== 'pending') {\n      throw new NotFoundError('Authorization session not found or expired');\n    }\n\n    return session;\n  }\n\n  public async approveAuthorizationSession(opts: {\n    sessionId: string;\n    userEntityRef: string;\n  }) {\n    const { sessionId, userEntityRef } = opts;\n    const session = await this.getValidPendingSession(sessionId);\n\n    await this.oidc.updateAuthorizationSession({\n      id: session.id,\n      userEntityRef,\n      status: 'approved',\n    });\n\n    const authorizationCode = crypto.randomBytes(32).toString('base64url');\n    const codeExpiresAt = DateTime.now().plus({ minutes: 10 }).toJSDate();\n\n    await this.oidc.createAuthorizationCode({\n      code: authorizationCode,\n      sessionId: session.id,\n      expiresAt: codeExpiresAt,\n    });\n\n    const redirectUrl = new URL(session.redirectUri);\n\n    redirectUrl.searchParams.append('code', authorizationCode);\n    if (session.state) {\n      redirectUrl.searchParams.append('state', session.state);\n    }\n\n    return {\n      redirectUrl: redirectUrl.toString(),\n    };\n  }\n\n  public async getAuthorizationSession(opts: { sessionId: string }) {\n    const session = await this.getValidPendingSession(opts.sessionId);\n    const { clientName } = await this.resolveClient({\n      clientId: session.clientId,\n    });\n\n    return {\n      id: session.id,\n      clientId: session.clientId,\n      clientName,\n      redirectUri: session.redirectUri,\n      scope: session.scope,\n      state: session.state,\n      responseType: session.responseType,\n      codeChallenge: session.codeChallenge,\n      codeChallengeMethod: session.codeChallengeMethod,\n      nonce: session.nonce,\n      expiresAt: session.expiresAt,\n      status: session.status,\n    };\n  }\n\n  public async rejectAuthorizationSession(opts: {\n    sessionId: string;\n    userEntityRef: string;\n  }) {\n    const { sessionId, userEntityRef } = opts;\n    const session = await this.getValidPendingSession(sessionId);\n\n    await this.oidc.updateAuthorizationSession({\n      id: session.id,\n      status: 'rejected',\n      userEntityRef,\n    });\n  }\n\n  public async exchangeCodeForToken(params: {\n    code: string;\n    redirectUri: string;\n    codeVerifier?: string;\n    grantType: string;\n  }) {\n    const { code, redirectUri, codeVerifier, grantType } = params;\n\n    if (grantType !== 'authorization_code') {\n      throw new InputError('Unsupported grant type');\n    }\n\n    const authCode = await this.oidc.getAuthorizationCode({ code });\n    if (!authCode) {\n      throw new AuthenticationError('Invalid authorization code');\n    }\n\n    if (DateTime.fromJSDate(authCode.expiresAt) < DateTime.now()) {\n      throw new AuthenticationError('Authorization code expired');\n    }\n\n    if (authCode.used) {\n      throw new AuthenticationError('Authorization code already used');\n    }\n\n    const session = await this.oidc.getAuthorizationSession({\n      id: authCode.sessionId,\n    });\n\n    if (!session) {\n      throw new NotFoundError('Invalid authorization session');\n    }\n\n    if (session.redirectUri !== redirectUri) {\n      throw new AuthenticationError('Redirect URI mismatch');\n    }\n\n    if (session.status !== 'approved') {\n      throw new AuthenticationError('Authorization not approved');\n    }\n\n    if (!session.userEntityRef) {\n      throw new AuthenticationError('No user associated with authorization');\n    }\n\n    if (session.codeChallenge) {\n      if (!codeVerifier) {\n        throw new AuthenticationError('Code verifier required for PKCE');\n      }\n\n      if (\n        !this.verifyPkce({\n          codeChallenge: session.codeChallenge,\n          codeVerifier,\n          method: session.codeChallengeMethod,\n        })\n      ) {\n        throw new AuthenticationError('Invalid code verifier');\n      }\n    }\n\n    await this.oidc.updateAuthorizationCode({\n      code,\n      used: true,\n    });\n\n    const { token } = await this.tokenIssuer.issueToken({\n      claims: {\n        sub: session.userEntityRef,\n      },\n    });\n\n    // Check if offline_access scope is requested\n    let refreshToken: string | undefined;\n    const scopes = session.scope?.split(' ') ?? [];\n    if (scopes.includes('offline_access') && this.offlineAccess) {\n      try {\n        refreshToken = await this.offlineAccess.issueRefreshToken({\n          userEntityRef: session.userEntityRef,\n          oidcClientId: session.clientId,\n        });\n      } catch (err) {\n        // Don't fail the entire token exchange if refresh token issuance fails.\n        // The access token is still valid and should be returned.\n        this.logger.warn(\n          `Failed to issue refresh token for user ${session.userEntityRef}, offline_access will not be available: ${err}`,\n        );\n      }\n    }\n\n    return {\n      accessToken: token,\n      tokenType: 'Bearer',\n      expiresIn: 3600,\n      idToken: token,\n      scope: session.scope || 'openid',\n      refreshToken,\n    };\n  }\n\n  public async refreshAccessToken(params: {\n    refreshToken: string;\n    clientId?: string;\n  }): Promise<{\n    accessToken: string;\n    tokenType: string;\n    expiresIn: number;\n    refreshToken: string;\n  }> {\n    if (!this.offlineAccess) {\n      throw new InputError('Refresh tokens are not enabled');\n    }\n\n    const { accessToken, refreshToken } =\n      await this.offlineAccess.refreshAccessToken({\n        refreshToken: params.refreshToken,\n        tokenIssuer: this.tokenIssuer,\n        clientId: params.clientId,\n      });\n\n    return {\n      accessToken,\n      tokenType: 'Bearer',\n      expiresIn: 3600,\n      refreshToken,\n    };\n  }\n\n  /**\n   * Verifies client credentials against the registered OIDC clients\n   */\n  public async verifyClientCredentials(options: {\n    clientId: string;\n    clientSecret: string;\n  }): Promise<boolean> {\n    const { clientId, clientSecret } = options;\n    const client = await this.oidc.getClient({ clientId });\n    if (!client?.clientSecret) {\n      return false;\n    }\n    const expected = Buffer.from(client.clientSecret, 'utf8');\n    const provided = Buffer.from(clientSecret, 'utf8');\n    if (expected.length !== provided.length) {\n      return false;\n    }\n    return crypto.timingSafeEqual(expected, provided);\n  }\n\n  /**\n   * Revoke a refresh token if offline access is enabled\n   */\n  public async revokeRefreshToken(token: string): Promise<void> {\n    if (!this.offlineAccess) {\n      return;\n    }\n    await this.offlineAccess.revokeRefreshToken(token);\n  }\n\n  private verifyPkce(opts: {\n    codeChallenge: string;\n    codeVerifier: string;\n    method?: string;\n  }): boolean {\n    if (!opts.method || opts.method === 'plain') {\n      return opts.codeChallenge === opts.codeVerifier;\n    }\n\n    if (opts.method === 'S256') {\n      const hash = crypto\n        .createHash('sha256')\n        .update(opts.codeVerifier)\n        .digest('base64url');\n      return opts.codeChallenge === hash;\n    }\n\n    return false;\n  }\n}\n"],"names":["matcher","InputError","decodeJwt","crypto","DateTime","validateCimdUrl","fetchCimdMetadata","NotFoundError","AuthenticationError"],"mappings":";;;;;;;;;;;;;;AAmCA,SAAS,mBAAA,CACP,aACA,eAAA,EACM;AACN,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,WAAW,CAAA;AAClC,EAAA,MAAM,UAAA,GAAa,GAAG,MAAA,CAAO,QAAQ,KAAK,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,CAAA;AAEvE,EAAA,IAAI,CAAC,gBAAgB,IAAA,CAAK,CAAA,OAAA,KAAWA,yBAAQ,OAAA,CAAQ,UAAA,EAAY,OAAO,CAAC,CAAA,EAAG;AAC1E,IAAA,MAAM,IAAIC,kBAAW,sBAAsB,CAAA;AAAA,EAC7C;AACF;AAEA,MAAM,cAAA,GAAiB,CAAC,WAAA,EAAa,WAAA,EAAa,OAAO,CAAA;AAOzD,SAAS,kBAAA,CACP,YACA,cAAA,EACS;AACT,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,UAAU,CAAA;AAEpC,EAAA,IAAI,CAAC,cAAA,CAAe,QAAA,CAAS,SAAA,CAAU,QAAQ,CAAA,EAAG;AAChD,IAAA,OAAO,cAAA,CAAe,SAAS,UAAU,CAAA;AAAA,EAC3C;AAEA,EAAA,OAAO,cAAA,CAAe,KAAK,CAAA,UAAA,KAAc;AACvC,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,IAAI,IAAI,UAAU,CAAA;AAAA,IAC1B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,OACE,cAAA,CAAe,QAAA,CAAS,GAAA,CAAI,QAAQ,KACpC,GAAA,CAAI,QAAA,KAAa,SAAA,CAAU,QAAA,IAC3B,IAAI,QAAA,KAAa,SAAA,CAAU,QAAA,IAC3B,GAAA,CAAI,aAAa,SAAA,CAAU,QAAA;AAAA,EAE/B,CAAC,CAAA;AACH;AAEO,MAAM,WAAA,CAAY;AAAA,EACN,IAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EAET,WAAA,CACN,MACA,WAAA,EACA,OAAA,EACA,UACA,IAAA,EACA,MAAA,EACA,QACA,aAAA,EACA;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AAAA,EACvB;AAAA,EAEA,OAAO,OAAO,OAAA,EASX;AACD,IAAA,OAAO,IAAI,WAAA;AAAA,MACT,OAAA,CAAQ,IAAA;AAAA,MACR,OAAA,CAAQ,WAAA;AAAA,MACR,OAAA,CAAQ,OAAA;AAAA,MACR,OAAA,CAAQ,QAAA;AAAA,MACR,OAAA,CAAQ,IAAA;AAAA,MACR,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACV;AAAA,EACF;AAAA,EAEO,gBAAA,GAAmB;AACxB,IAAA,MAAM,UAAA,GAAa,KAAK,MAAA,CAAO,kBAAA;AAAA,MAC7B;AAAA,KACF;AACA,IAAA,MAAM,EAAE,OAAA,EAAS,WAAA,EAAY,GAAI,KAAK,aAAA,EAAc;AAEpD,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,OAAA;AAAA,MACb,cAAA,EAAgB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,SAAA,CAAA;AAAA,MAC/B,iBAAA,EAAmB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,YAAA,CAAA;AAAA,MAClC,QAAA,EAAU,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAA;AAAA,MACzB,wBAAA,EAA0B,CAAC,MAAA,EAAQ,UAAU,CAAA;AAAA,MAC7C,uBAAA,EAAyB,CAAC,QAAQ,CAAA;AAAA,MAClC,qCAAA,EAAuC;AAAA,QACrC,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,gBAAA,EAAkB;AAAA,QAChB,QAAA;AAAA,QACA,GAAI,IAAA,CAAK,aAAA,GAAgB,CAAC,gBAAgB,IAAI;AAAC,OACjD;AAAA,MACA,qCAAA,EAAuC;AAAA,QACrC,qBAAA;AAAA,QACA,oBAAA;AAAA,QACA,GAAI,WAAA,GAAc,CAAC,MAAM,IAAI;AAAC,OAChC;AAAA,MACA,gBAAA,EAAkB,CAAC,KAAA,EAAO,KAAK,CAAA;AAAA,MAC/B,qBAAA,EAAuB;AAAA,QACrB,oBAAA;AAAA,QACA,GAAI,IAAA,CAAK,aAAA,GAAgB,CAAC,eAAe,IAAI;AAAC,OAChD;AAAA,MACA,sBAAA,EAAwB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,aAAA,CAAA;AAAA,MACvC,gCAAA,EAAkC,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,MAClD,GAAI,UAAA,IAAc;AAAA,QAChB,qBAAA,EAAuB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,YAAA,CAAA;AAAA,QACtC,mBAAA,EAAqB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,UAAA;AAAA,OACtC;AAAA,MACA,GAAI,WAAA,IAAe,EAAE,qCAAA,EAAuC,IAAA;AAAK,KACnE;AAAA,EACF;AAAA,EAEA,MAAa,cAAA,GAAiB;AAC5B,IAAA,OAAO,MAAM,IAAA,CAAK,WAAA,CAAY,cAAA,EAAe;AAAA,EAC/C;AAAA,EAEA,MAAa,WAAA,CAAY,EAAE,KAAA,EAAM,EAAsB;AACrD,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,IAAA,CAAK,aAAa,KAAA,EAAO;AAAA,MACtD,kBAAA,EAAoB;AAAA,KACrB,CAAA;AACD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,WAAA,CAAY,WAAA,EAAa,MAAM,CAAA,EAAG;AAC/C,MAAA,MAAM,IAAIA,iBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,EAAE,GAAA,EAAK,aAAA,EAAc,GAAIC,eAAU,KAAK,CAAA;AAE9C,IAAA,IAAI,OAAO,kBAAkB,QAAA,EAAU;AACrC,MAAA,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAAA,IACxE;AACA,IAAA,OAAO,MAAM,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,aAAa,CAAA;AAAA,EACtD;AAAA,EAEA,MAAa,eAAe,IAAA,EAMzB;AACD,IAAA,MAAM,iBAAA,GAAoBC,wBAAO,UAAA,EAAW;AAC5C,IAAA,MAAM,qBAAA,GAAwBA,wBAAO,UAAA,EAAW;AAEhD,IAAA,MAAM,0BAAA,GAA6B,KAAK,MAAA,CAAO,sBAAA;AAAA,MAC7C;AAAA,KACF,IAAK,CAAC,GAAG,CAAA;AAET,IAAA,KAAA,MAAW,WAAA,IAAe,IAAA,CAAK,YAAA,IAAgB,EAAC,EAAG;AACjD,MAAA,mBAAA,CAAoB,aAAa,0BAA0B,CAAA;AAAA,IAC7D;AAEA,IAAA,OAAO,MAAM,IAAA,CAAK,IAAA,CAAK,YAAA,CAAa;AAAA,MAClC,QAAA,EAAU,iBAAA;AAAA,MACV,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,YAAA,EAAc,qBAAA;AAAA,MACd,YAAA,EAAc,IAAA,CAAK,YAAA,IAAgB,EAAC;AAAA,MACpC,aAAA,EAAe,IAAA,CAAK,aAAA,IAAiB,CAAC,MAAM,CAAA;AAAA,MAC5C,UAAA,EAAY,IAAA,CAAK,UAAA,IAAc,CAAC,oBAAoB,CAAA;AAAA,MACpD,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH;AAAA,EAEA,MAAa,2BAA2B,IAAA,EASrC;AACD,IAAA,MAAM;AAAA,MACJ,QAAA;AAAA,MACA,WAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,aAAA;AAAA,MACA;AAAA,KACF,GAAI,IAAA;AAEJ,IAAA,IAAI,iBAAiB,MAAA,EAAQ;AAC3B,MAAA,MAAM,IAAIF,kBAAW,2CAA2C,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,cAAc,EAAE,QAAA,EAAU,aAAa,CAAA;AAEjE,IAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,aAAA,EAAe;AACzC,MAAA,MAAM,IAAIA,iBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,IACE,CAAC,uBACD,CAAC,CAAC,QAAQ,OAAO,CAAA,CAAE,QAAA,CAAS,mBAAmB,CAAA,EAC/C;AACA,QAAA,MAAM,IAAIA,kBAAW,+BAA+B,CAAA;AAAA,MACtD;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAYE,wBAAO,UAAA,EAAW;AACpC,IAAA,MAAM,gBAAA,GAAmBC,cAAA,CAAS,GAAA,EAAI,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,EAAG,CAAA,CAAE,QAAA,EAAS;AAEpE,IAAA,MAAM,IAAA,CAAK,KAAK,0BAAA,CAA2B;AAAA,MACzC,EAAA,EAAI,SAAA;AAAA,MACJ,QAAA;AAAA,MACA,WAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,aAAA;AAAA,MACA,mBAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,SAAA;AAAA,MACJ,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,KAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEQ,aAAA,GAAgB;AACtB,IAAA,OAAO;AAAA,MACL,OAAA,EACE,KAAK,MAAA,CAAO,kBAAA;AAAA,QACV;AAAA,OACF,IAAK,KAAA;AAAA,MACP,uBAAA,EAAyB,KAAK,MAAA,CAAO,sBAAA;AAAA,QACnC;AAAA,OACF,IAAK,CAAC,GAAG,CAAA;AAAA,MACT,0BAAA,EAA4B,KAAK,MAAA,CAAO,sBAAA;AAAA,QACtC;AAAA,OACF,IAAK,CAAC,GAAG;AAAA,KACX;AAAA,EACF;AAAA,EAEA,MAAc,cAAc,IAAA,EAGzB;AACD,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAUC,0BAAA,CAAgB,KAAK,QAAQ,CAAA;AAAA,IACzC,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,OAAO,KAAK,iBAAA,CAAkB,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAAA,IACpD;AACA,IAAA,OAAO,IAAA,CAAK,iBAAiB,IAAI,CAAA;AAAA,EACnC;AAAA,EAEA,MAAc,kBAAkB,IAAA,EAI7B;AACD,IAAA,MAAM,IAAA,GAAO,KAAK,aAAA,EAAc;AAEhC,IAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,MAAA,MAAM,IAAIJ,kBAAW,0CAA0C,CAAA;AAAA,IACjE;AAEA,IAAA,IACE,CAAC,KAAK,uBAAA,CAAwB,IAAA;AAAA,MAAK,CAAA,OAAA,KACjCD,wBAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,UAAU,OAAO;AAAA,KACxC,EACA;AACA,MAAA,MAAM,IAAIC,kBAAW,mBAAmB,CAAA;AAAA,IAC1C;AAEA,IAAA,MAAM,UAAA,GAAa,MAAMK,4BAAA,CAAkB;AAAA,MACzC,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,cAAc,IAAA,CAAK;AAAA,KACpB,CAAA;AAED,IAAA,IAAI,KAAK,WAAA,EAAa;AACpB,MAAA,mBAAA,CAAoB,IAAA,CAAK,WAAA,EAAa,IAAA,CAAK,0BAA0B,CAAA;AAErE,MAAA,IAAI,CAAC,kBAAA,CAAmB,IAAA,CAAK,WAAA,EAAa,UAAA,CAAW,YAAY,CAAA,EAAG;AAClE,QAAA,MAAM,IAAIL,kBAAW,6BAA6B,CAAA;AAAA,MACpD;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,YAAY,UAAA,CAAW,UAAA;AAAA,MACvB,cAAc,UAAA,CAAW,YAAA;AAAA,MACzB,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,MAAc,iBAAiB,IAAA,EAG5B;AACD,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,UAAU,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAU,CAAA;AACpE,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAIA,kBAAW,mBAAmB,CAAA;AAAA,IAC1C;AAEA,IAAA,IAAI,IAAA,CAAK,eAAe,CAAC,MAAA,CAAO,aAAa,QAAA,CAAS,IAAA,CAAK,WAAW,CAAA,EAAG;AACvE,MAAA,MAAM,IAAIA,kBAAW,sBAAsB,CAAA;AAAA,IAC7C;AAEA,IAAA,OAAO;AAAA,MACL,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,cAAc,MAAA,CAAO,YAAA;AAAA,MACrB,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,MAAc,uBAAuB,SAAA,EAAmB;AACtD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,wBAAwB,EAAE,EAAA,EAAI,WAAW,CAAA;AAEzE,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIM,qBAAc,+BAA+B,CAAA;AAAA,IACzD;AAEA,IAAA,IAAIH,eAAS,UAAA,CAAW,OAAA,CAAQ,SAAS,CAAA,GAAIA,cAAA,CAAS,KAAI,EAAG;AAC3D,MAAA,MAAM,IAAIH,kBAAW,+BAA+B,CAAA;AAAA,IACtD;AAEA,IAAA,IAAI,OAAA,CAAQ,WAAW,SAAA,EAAW;AAChC,MAAA,MAAM,IAAIM,qBAAc,4CAA4C,CAAA;AAAA,IACtE;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAa,4BAA4B,IAAA,EAGtC;AACD,IAAA,MAAM,EAAE,SAAA,EAAW,aAAA,EAAc,GAAI,IAAA;AACrC,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,sBAAA,CAAuB,SAAS,CAAA;AAE3D,IAAA,MAAM,IAAA,CAAK,KAAK,0BAAA,CAA2B;AAAA,MACzC,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,aAAA;AAAA,MACA,MAAA,EAAQ;AAAA,KACT,CAAA;AAED,IAAA,MAAM,oBAAoBJ,uBAAA,CAAO,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACrE,IAAA,MAAM,aAAA,GAAgBC,cAAA,CAAS,GAAA,EAAI,CAAE,IAAA,CAAK,EAAE,OAAA,EAAS,EAAA,EAAI,CAAA,CAAE,QAAA,EAAS;AAEpE,IAAA,MAAM,IAAA,CAAK,KAAK,uBAAA,CAAwB;AAAA,MACtC,IAAA,EAAM,iBAAA;AAAA,MACN,WAAW,OAAA,CAAQ,EAAA;AAAA,MACnB,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAW,CAAA;AAE/C,IAAA,WAAA,CAAY,YAAA,CAAa,MAAA,CAAO,MAAA,EAAQ,iBAAiB,CAAA;AACzD,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,WAAA,CAAY,YAAA,CAAa,MAAA,CAAO,OAAA,EAAS,OAAA,CAAQ,KAAK,CAAA;AAAA,IACxD;AAEA,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,YAAY,QAAA;AAAS,KACpC;AAAA,EACF;AAAA,EAEA,MAAa,wBAAwB,IAAA,EAA6B;AAChE,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,sBAAA,CAAuB,KAAK,SAAS,CAAA;AAChE,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,KAAK,aAAA,CAAc;AAAA,MAC9C,UAAU,OAAA,CAAQ;AAAA,KACnB,CAAA;AAED,IAAA,OAAO;AAAA,MACL,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,UAAA;AAAA,MACA,aAAa,OAAA,CAAQ,WAAA;AAAA,MACrB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,cAAc,OAAA,CAAQ,YAAA;AAAA,MACtB,eAAe,OAAA,CAAQ,aAAA;AAAA,MACvB,qBAAqB,OAAA,CAAQ,mBAAA;AAAA,MAC7B,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,QAAQ,OAAA,CAAQ;AAAA,KAClB;AAAA,EACF;AAAA,EAEA,MAAa,2BAA2B,IAAA,EAGrC;AACD,IAAA,MAAM,EAAE,SAAA,EAAW,aAAA,EAAc,GAAI,IAAA;AACrC,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,sBAAA,CAAuB,SAAS,CAAA;AAE3D,IAAA,MAAM,IAAA,CAAK,KAAK,0BAAA,CAA2B;AAAA,MACzC,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,MAAA,EAAQ,UAAA;AAAA,MACR;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,MAAa,qBAAqB,MAAA,EAK/B;AACD,IAAA,MAAM,EAAE,IAAA,EAAM,WAAA,EAAa,YAAA,EAAc,WAAU,GAAI,MAAA;AAEvD,IAAA,IAAI,cAAc,oBAAA,EAAsB;AACtC,MAAA,MAAM,IAAIH,kBAAW,wBAAwB,CAAA;AAAA,IAC/C;AAEA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,KAAK,oBAAA,CAAqB,EAAE,MAAM,CAAA;AAC9D,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAIO,2BAAoB,4BAA4B,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAIJ,eAAS,UAAA,CAAW,QAAA,CAAS,SAAS,CAAA,GAAIA,cAAA,CAAS,KAAI,EAAG;AAC5D,MAAA,MAAM,IAAII,2BAAoB,4BAA4B,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,MAAM,IAAIA,2BAAoB,iCAAiC,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,uBAAA,CAAwB;AAAA,MACtD,IAAI,QAAA,CAAS;AAAA,KACd,CAAA;AAED,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAID,qBAAc,+BAA+B,CAAA;AAAA,IACzD;AAEA,IAAA,IAAI,OAAA,CAAQ,gBAAgB,WAAA,EAAa;AACvC,MAAA,MAAM,IAAIC,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,IAAI,OAAA,CAAQ,WAAW,UAAA,EAAY;AACjC,MAAA,MAAM,IAAIA,2BAAoB,4BAA4B,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AAC1B,MAAA,MAAM,IAAIA,2BAAoB,uCAAuC,CAAA;AAAA,IACvE;AAEA,IAAA,IAAI,QAAQ,aAAA,EAAe;AACzB,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA,MAAM,IAAIA,2BAAoB,iCAAiC,CAAA;AAAA,MACjE;AAEA,MAAA,IACE,CAAC,KAAK,UAAA,CAAW;AAAA,QACf,eAAe,OAAA,CAAQ,aAAA;AAAA,QACvB,YAAA;AAAA,QACA,QAAQ,OAAA,CAAQ;AAAA,OACjB,CAAA,EACD;AACA,QAAA,MAAM,IAAIA,2BAAoB,uBAAuB,CAAA;AAAA,MACvD;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,CAAK,KAAK,uBAAA,CAAwB;AAAA,MACtC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,IAAA,CAAK,YAAY,UAAA,CAAW;AAAA,MAClD,MAAA,EAAQ;AAAA,QACN,KAAK,OAAA,CAAQ;AAAA;AACf,KACD,CAAA;AAGD,IAAA,IAAI,YAAA;AACJ,IAAA,MAAM,SAAS,OAAA,CAAQ,KAAA,EAAO,KAAA,CAAM,GAAG,KAAK,EAAC;AAC7C,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,gBAAgB,CAAA,IAAK,KAAK,aAAA,EAAe;AAC3D,MAAA,IAAI;AACF,QAAA,YAAA,GAAe,MAAM,IAAA,CAAK,aAAA,CAAc,iBAAA,CAAkB;AAAA,UACxD,eAAe,OAAA,CAAQ,aAAA;AAAA,UACvB,cAAc,OAAA,CAAQ;AAAA,SACvB,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AAGZ,QAAA,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,UACV,CAAA,uCAAA,EAA0C,OAAA,CAAQ,aAAa,CAAA,wCAAA,EAA2C,GAAG,CAAA;AAAA,SAC/G;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,KAAA;AAAA,MACb,SAAA,EAAW,QAAA;AAAA,MACX,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO,QAAQ,KAAA,IAAS,QAAA;AAAA,MACxB;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAa,mBAAmB,MAAA,EAQ7B;AACD,IAAA,IAAI,CAAC,KAAK,aAAA,EAAe;AACvB,MAAA,MAAM,IAAIP,kBAAW,gCAAgC,CAAA;AAAA,IACvD;AAEA,IAAA,MAAM,EAAE,WAAA,EAAa,YAAA,KACnB,MAAM,IAAA,CAAK,cAAc,kBAAA,CAAmB;AAAA,MAC1C,cAAc,MAAA,CAAO,YAAA;AAAA,MACrB,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,UAAU,MAAA,CAAO;AAAA,KAClB,CAAA;AAEH,IAAA,OAAO;AAAA,MACL,WAAA;AAAA,MACA,SAAA,EAAW,QAAA;AAAA,MACX,SAAA,EAAW,IAAA;AAAA,MACX;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,wBAAwB,OAAA,EAGhB;AACnB,IAAA,MAAM,EAAE,QAAA,EAAU,YAAA,EAAa,GAAI,OAAA;AACnC,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,KAAK,SAAA,CAAU,EAAE,UAAU,CAAA;AACrD,IAAA,IAAI,CAAC,QAAQ,YAAA,EAAc;AACzB,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,cAAc,MAAM,CAAA;AACxD,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,MAAM,CAAA;AACjD,IAAA,IAAI,QAAA,CAAS,MAAA,KAAW,QAAA,CAAS,MAAA,EAAQ;AACvC,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,OAAOE,uBAAA,CAAO,eAAA,CAAgB,QAAA,EAAU,QAAQ,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,mBAAmB,KAAA,EAA8B;AAC5D,IAAA,IAAI,CAAC,KAAK,aAAA,EAAe;AACvB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,aAAA,CAAc,kBAAA,CAAmB,KAAK,CAAA;AAAA,EACnD;AAAA,EAEQ,WAAW,IAAA,EAIP;AACV,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,WAAW,OAAA,EAAS;AAC3C,MAAA,OAAO,IAAA,CAAK,kBAAkB,IAAA,CAAK,YAAA;AAAA,IACrC;AAEA,IAAA,IAAI,IAAA,CAAK,WAAW,MAAA,EAAQ;AAC1B,MAAA,MAAM,IAAA,GAAOA,uBAAA,CACV,UAAA,CAAW,QAAQ,CAAA,CACnB,OAAO,IAAA,CAAK,YAAY,CAAA,CACxB,MAAA,CAAO,WAAW,CAAA;AACrB,MAAA,OAAO,KAAK,aAAA,KAAkB,IAAA;AAAA,IAChC;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;;"}
+{"version":3,"file":"OidcService.cjs.js","sources":["../../src/service/OidcService.ts"],"sourcesContent":["/*\n * Copyright 2025 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  AuthService,\n  LoggerService,\n  RootConfigService,\n} from '@backstage/backend-plugin-api';\nimport { TokenIssuer } from '../identity/types';\nimport { UserInfoDatabase } from '../database/UserInfoDatabase';\nimport {\n  AuthenticationError,\n  InputError,\n  NotFoundError,\n} from '@backstage/errors';\nimport { decodeJwt } from 'jose';\nimport crypto from 'node:crypto';\nimport { OidcDatabase } from '../database/OidcDatabase';\nimport { DateTime } from 'luxon';\nimport matcher from 'matcher';\nimport { OfflineAccessService } from './OfflineAccessService';\nimport { validateCimdUrl, fetchCimdMetadata } from './CimdClient';\n\nfunction validateRedirectUri(\n  redirectUri: string,\n  allowedPatterns: string[],\n): void {\n  const parsed = new URL(redirectUri);\n  const normalized = `${parsed.protocol}//${parsed.host}${parsed.pathname}`;\n\n  if (!allowedPatterns.some(pattern => matcher.isMatch(normalized, pattern))) {\n    throw new InputError(`Invalid redirect_uri '${normalized}'`);\n  }\n}\n\nconst LOOPBACK_HOSTS = ['localhost', '127.0.0.1', '[::1]'];\nconst LOOPBACK_REDIRECT_PATTERNS = [\n  'http://localhost:*',\n  'http://localhost/*',\n  'http://127.0.0.1:*',\n  'http://127.0.0.1/*',\n  'http://[::1]:*',\n  'http://[::1]/*',\n];\n\n/**\n * RFC 8252 Section 7.3: For loopback redirect URIs, the authorization server\n * MUST allow any port to be specified at the time of the request. This matches\n * redirect URIs by scheme, hostname, and path only, ignoring the port.\n */\nfunction matchesRedirectUri(\n  requestUri: string,\n  registeredUris: string[],\n): boolean {\n  const requested = new URL(requestUri);\n\n  if (!LOOPBACK_HOSTS.includes(requested.hostname)) {\n    return registeredUris.includes(requestUri);\n  }\n\n  return registeredUris.some(registered => {\n    let reg: URL;\n    try {\n      reg = new URL(registered);\n    } catch {\n      return false;\n    }\n    return (\n      LOOPBACK_HOSTS.includes(reg.hostname) &&\n      reg.protocol === requested.protocol &&\n      reg.hostname === requested.hostname &&\n      reg.pathname === requested.pathname\n    );\n  });\n}\n\nexport class OidcService {\n  private readonly auth: AuthService;\n  private readonly tokenIssuer: TokenIssuer;\n  private readonly baseUrl: string;\n  private readonly userInfo: UserInfoDatabase;\n  private readonly oidc: OidcDatabase;\n  private readonly config: RootConfigService;\n  private readonly logger: LoggerService;\n  private readonly offlineAccess?: OfflineAccessService;\n\n  private constructor(\n    auth: AuthService,\n    tokenIssuer: TokenIssuer,\n    baseUrl: string,\n    userInfo: UserInfoDatabase,\n    oidc: OidcDatabase,\n    config: RootConfigService,\n    logger: LoggerService,\n    offlineAccess?: OfflineAccessService,\n  ) {\n    this.auth = auth;\n    this.tokenIssuer = tokenIssuer;\n    this.baseUrl = baseUrl;\n    this.userInfo = userInfo;\n    this.oidc = oidc;\n    this.config = config;\n    this.logger = logger;\n    this.offlineAccess = offlineAccess;\n  }\n\n  static create(options: {\n    auth: AuthService;\n    tokenIssuer: TokenIssuer;\n    baseUrl: string;\n    userInfo: UserInfoDatabase;\n    oidc: OidcDatabase;\n    config: RootConfigService;\n    logger: LoggerService;\n    offlineAccess?: OfflineAccessService;\n  }) {\n    return new OidcService(\n      options.auth,\n      options.tokenIssuer,\n      options.baseUrl,\n      options.userInfo,\n      options.oidc,\n      options.config,\n      options.logger,\n      options.offlineAccess,\n    );\n  }\n\n  public getConfiguration() {\n    const dcrEnabled = this.config.getOptionalBoolean(\n      'auth.experimentalDynamicClientRegistration.enabled',\n    );\n    const { enabled: cimdEnabled } = this.getCimdConfig();\n\n    return {\n      issuer: this.baseUrl,\n      token_endpoint: `${this.baseUrl}/v1/token`,\n      userinfo_endpoint: `${this.baseUrl}/v1/userinfo`,\n      jwks_uri: `${this.baseUrl}/.well-known/jwks.json`,\n      response_types_supported: ['code', 'id_token'],\n      subject_types_supported: ['public'],\n      id_token_signing_alg_values_supported: [\n        'RS256',\n        'RS384',\n        'RS512',\n        'ES256',\n        'ES384',\n        'ES512',\n        'PS256',\n        'PS384',\n        'PS512',\n        'EdDSA',\n      ],\n      scopes_supported: [\n        'openid',\n        ...(this.offlineAccess ? ['offline_access'] : []),\n      ],\n      token_endpoint_auth_methods_supported: [\n        'client_secret_basic',\n        'client_secret_post',\n        ...(cimdEnabled ? ['none'] : []),\n      ],\n      claims_supported: ['sub', 'ent'],\n      grant_types_supported: [\n        'authorization_code',\n        ...(this.offlineAccess ? ['refresh_token'] : []),\n      ],\n      authorization_endpoint: `${this.baseUrl}/v1/authorize`,\n      code_challenge_methods_supported: ['S256', 'plain'],\n      ...(dcrEnabled && {\n        registration_endpoint: `${this.baseUrl}/v1/register`,\n        revocation_endpoint: `${this.baseUrl}/v1/revoke`,\n      }),\n      ...(cimdEnabled && { client_id_metadata_document_supported: true }),\n    };\n  }\n\n  public async listPublicKeys() {\n    return await this.tokenIssuer.listPublicKeys();\n  }\n\n  public async getUserInfo({ token }: { token: string }) {\n    const credentials = await this.auth.authenticate(token, {\n      allowLimitedAccess: true,\n    });\n    if (!this.auth.isPrincipal(credentials, 'user')) {\n      throw new InputError(\n        'Userinfo endpoint must be called with a token that represents a user principal',\n      );\n    }\n\n    const { sub: userEntityRef } = decodeJwt(token);\n\n    if (typeof userEntityRef !== 'string') {\n      throw new Error('Invalid user token, user entity ref must be a string');\n    }\n    return await this.userInfo.getUserInfo(userEntityRef);\n  }\n\n  public async registerClient(opts: {\n    responseTypes?: string[];\n    grantTypes?: string[];\n    clientName: string;\n    redirectUris?: string[];\n    scope?: string;\n  }) {\n    const generatedClientId = crypto.randomUUID();\n    const generatedClientSecret = crypto.randomUUID();\n\n    const allowedRedirectUriPatterns = this.config.getOptionalStringArray(\n      'auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns',\n    ) ?? [\n      'cursor://*',\n      'https://www.cursor.com/*',\n      ...LOOPBACK_REDIRECT_PATTERNS,\n    ];\n\n    for (const redirectUri of opts.redirectUris ?? []) {\n      validateRedirectUri(redirectUri, allowedRedirectUriPatterns);\n    }\n\n    return await this.oidc.createClient({\n      clientId: generatedClientId,\n      clientName: opts.clientName,\n      clientSecret: generatedClientSecret,\n      redirectUris: opts.redirectUris ?? [],\n      responseTypes: opts.responseTypes ?? ['code'],\n      grantTypes: opts.grantTypes ?? ['authorization_code'],\n      scope: opts.scope,\n    });\n  }\n\n  public async createAuthorizationSession(opts: {\n    clientId: string;\n    redirectUri: string;\n    responseType: string;\n    scope?: string;\n    state?: string;\n    nonce?: string;\n    codeChallenge?: string;\n    codeChallengeMethod?: string;\n  }) {\n    const {\n      clientId,\n      redirectUri,\n      responseType,\n      scope,\n      state,\n      nonce,\n      codeChallenge,\n      codeChallengeMethod,\n    } = opts;\n\n    if (responseType !== 'code') {\n      throw new InputError('Only authorization code flow is supported');\n    }\n\n    const client = await this.resolveClient({ clientId, redirectUri });\n\n    if (client.requiresPkce && !codeChallenge) {\n      throw new InputError(\n        'PKCE is required for public clients. Provide a code_challenge parameter.',\n      );\n    }\n\n    if (codeChallenge) {\n      if (\n        !codeChallengeMethod ||\n        !['S256', 'plain'].includes(codeChallengeMethod)\n      ) {\n        throw new InputError('Invalid code_challenge_method');\n      }\n    }\n\n    const sessionId = crypto.randomUUID();\n    const sessionExpiresAt = DateTime.now().plus({ hours: 1 }).toJSDate();\n\n    await this.oidc.createAuthorizationSession({\n      id: sessionId,\n      clientId,\n      redirectUri,\n      responseType,\n      scope,\n      state,\n      codeChallenge,\n      codeChallengeMethod,\n      nonce,\n      expiresAt: sessionExpiresAt,\n    });\n\n    return {\n      id: sessionId,\n      clientName: client.clientName,\n      scope,\n      redirectUri,\n    };\n  }\n\n  private getCimdConfig() {\n    const enabled =\n      this.config.getOptionalBoolean(\n        'auth.experimentalClientIdMetadataDocuments.enabled',\n      ) ?? false;\n\n    const cliClientId = `${this.baseUrl}/.well-known/oauth-client/cli.json`;\n\n    return {\n      enabled,\n      allowedClientIdPatterns: this.config.getOptionalStringArray(\n        'auth.experimentalClientIdMetadataDocuments.allowedClientIdPatterns',\n      ) ?? ['https://claude.ai/*', 'https://vscode.dev/*', cliClientId],\n      allowedRedirectUriPatterns:\n        this.config.getOptionalStringArray(\n          'auth.experimentalClientIdMetadataDocuments.allowedRedirectUriPatterns',\n        ) ?? LOOPBACK_REDIRECT_PATTERNS,\n    };\n  }\n\n  private async resolveClient(opts: {\n    clientId: string;\n    redirectUri?: string;\n  }) {\n    let cimdUrl: URL | undefined;\n    try {\n      cimdUrl = validateCimdUrl(opts.clientId);\n    } catch {\n      // Not a valid CIMD URL, fall through to DCR\n    }\n\n    if (cimdUrl) {\n      return this.resolveCimdClient({ ...opts, cimdUrl });\n    }\n    return this.resolveDcrClient(opts);\n  }\n\n  private async resolveCimdClient(opts: {\n    clientId: string;\n    cimdUrl: URL;\n    redirectUri?: string;\n  }) {\n    const cimd = this.getCimdConfig();\n\n    if (!cimd.enabled) {\n      throw new InputError('Client ID metadata documents not enabled');\n    }\n\n    if (\n      !cimd.allowedClientIdPatterns.some(pattern =>\n        matcher.isMatch(opts.clientId, pattern),\n      )\n    ) {\n      throw new InputError(`Invalid client_id '${opts.clientId}'`);\n    }\n\n    const cimdClient = await fetchCimdMetadata({\n      clientId: opts.clientId,\n      validatedUrl: opts.cimdUrl,\n    });\n\n    if (opts.redirectUri) {\n      validateRedirectUri(opts.redirectUri, cimd.allowedRedirectUriPatterns);\n\n      if (!matchesRedirectUri(opts.redirectUri, cimdClient.redirectUris)) {\n        throw new InputError(\n          `Invalid redirect_uri '${opts.redirectUri}', not registered in client metadata`,\n        );\n      }\n    }\n\n    return {\n      clientName: cimdClient.clientName,\n      redirectUris: cimdClient.redirectUris,\n      requiresPkce: true,\n    };\n  }\n\n  private async resolveDcrClient(opts: {\n    clientId: string;\n    redirectUri?: string;\n  }) {\n    const client = await this.oidc.getClient({ clientId: opts.clientId });\n    if (!client) {\n      throw new InputError('Invalid client_id');\n    }\n\n    if (opts.redirectUri && !client.redirectUris.includes(opts.redirectUri)) {\n      throw new InputError(`Invalid redirect_uri '${opts.redirectUri}'`);\n    }\n\n    return {\n      clientName: client.clientName,\n      redirectUris: client.redirectUris,\n      requiresPkce: false,\n    };\n  }\n\n  private async getValidPendingSession(sessionId: string) {\n    const session = await this.oidc.getAuthorizationSession({ id: sessionId });\n\n    if (!session) {\n      throw new NotFoundError('Invalid authorization session');\n    }\n\n    if (DateTime.fromJSDate(session.expiresAt) < DateTime.now()) {\n      throw new InputError('Authorization session expired');\n    }\n\n    if (session.status !== 'pending') {\n      throw new NotFoundError('Authorization session not found or expired');\n    }\n\n    return session;\n  }\n\n  public async approveAuthorizationSession(opts: {\n    sessionId: string;\n    userEntityRef: string;\n  }) {\n    const { sessionId, userEntityRef } = opts;\n    const session = await this.getValidPendingSession(sessionId);\n\n    await this.oidc.updateAuthorizationSession({\n      id: session.id,\n      userEntityRef,\n      status: 'approved',\n    });\n\n    const authorizationCode = crypto.randomBytes(32).toString('base64url');\n    const codeExpiresAt = DateTime.now().plus({ minutes: 10 }).toJSDate();\n\n    await this.oidc.createAuthorizationCode({\n      code: authorizationCode,\n      sessionId: session.id,\n      expiresAt: codeExpiresAt,\n    });\n\n    const redirectUrl = new URL(session.redirectUri);\n\n    redirectUrl.searchParams.append('code', authorizationCode);\n    if (session.state) {\n      redirectUrl.searchParams.append('state', session.state);\n    }\n\n    return {\n      redirectUrl: redirectUrl.toString(),\n    };\n  }\n\n  public async getAuthorizationSession(opts: { sessionId: string }) {\n    const session = await this.getValidPendingSession(opts.sessionId);\n    const { clientName } = await this.resolveClient({\n      clientId: session.clientId,\n    });\n\n    return {\n      id: session.id,\n      clientId: session.clientId,\n      clientName,\n      redirectUri: session.redirectUri,\n      scope: session.scope,\n      state: session.state,\n      responseType: session.responseType,\n      codeChallenge: session.codeChallenge,\n      codeChallengeMethod: session.codeChallengeMethod,\n      nonce: session.nonce,\n      expiresAt: session.expiresAt,\n      status: session.status,\n    };\n  }\n\n  public async rejectAuthorizationSession(opts: {\n    sessionId: string;\n    userEntityRef: string;\n  }) {\n    const { sessionId, userEntityRef } = opts;\n    const session = await this.getValidPendingSession(sessionId);\n\n    await this.oidc.updateAuthorizationSession({\n      id: session.id,\n      status: 'rejected',\n      userEntityRef,\n    });\n  }\n\n  public async exchangeCodeForToken(params: {\n    code: string;\n    redirectUri: string;\n    codeVerifier?: string;\n    grantType: string;\n  }) {\n    const { code, redirectUri, codeVerifier, grantType } = params;\n\n    if (grantType !== 'authorization_code') {\n      throw new InputError('Unsupported grant type');\n    }\n\n    const authCode = await this.oidc.getAuthorizationCode({ code });\n    if (!authCode) {\n      throw new AuthenticationError('Invalid authorization code');\n    }\n\n    if (DateTime.fromJSDate(authCode.expiresAt) < DateTime.now()) {\n      throw new AuthenticationError('Authorization code expired');\n    }\n\n    if (authCode.used) {\n      throw new AuthenticationError('Authorization code already used');\n    }\n\n    const session = await this.oidc.getAuthorizationSession({\n      id: authCode.sessionId,\n    });\n\n    if (!session) {\n      throw new NotFoundError('Invalid authorization session');\n    }\n\n    if (session.redirectUri !== redirectUri) {\n      throw new AuthenticationError('Redirect URI mismatch');\n    }\n\n    if (session.status !== 'approved') {\n      throw new AuthenticationError('Authorization not approved');\n    }\n\n    if (!session.userEntityRef) {\n      throw new AuthenticationError('No user associated with authorization');\n    }\n\n    if (session.codeChallenge) {\n      if (!codeVerifier) {\n        throw new AuthenticationError('Code verifier required for PKCE');\n      }\n\n      if (\n        !this.verifyPkce({\n          codeChallenge: session.codeChallenge,\n          codeVerifier,\n          method: session.codeChallengeMethod,\n        })\n      ) {\n        throw new AuthenticationError('Invalid code verifier');\n      }\n    }\n\n    await this.oidc.updateAuthorizationCode({\n      code,\n      used: true,\n    });\n\n    const { token } = await this.tokenIssuer.issueToken({\n      claims: {\n        sub: session.userEntityRef,\n      },\n    });\n\n    // Check if offline_access scope is requested\n    let refreshToken: string | undefined;\n    const scopes = session.scope?.split(' ') ?? [];\n    if (scopes.includes('offline_access') && this.offlineAccess) {\n      try {\n        refreshToken = await this.offlineAccess.issueRefreshToken({\n          userEntityRef: session.userEntityRef,\n          oidcClientId: session.clientId,\n        });\n      } catch (err) {\n        // Don't fail the entire token exchange if refresh token issuance fails.\n        // The access token is still valid and should be returned.\n        this.logger.warn(\n          `Failed to issue refresh token for user ${session.userEntityRef}, offline_access will not be available: ${err}`,\n        );\n      }\n    }\n\n    return {\n      accessToken: token,\n      tokenType: 'Bearer',\n      expiresIn: 3600,\n      idToken: token,\n      scope: session.scope || 'openid',\n      refreshToken,\n    };\n  }\n\n  public async refreshAccessToken(params: {\n    refreshToken: string;\n    clientId?: string;\n  }): Promise<{\n    accessToken: string;\n    tokenType: string;\n    expiresIn: number;\n    refreshToken: string;\n  }> {\n    if (!this.offlineAccess) {\n      throw new InputError('Refresh tokens are not enabled');\n    }\n\n    const { accessToken, refreshToken } =\n      await this.offlineAccess.refreshAccessToken({\n        refreshToken: params.refreshToken,\n        tokenIssuer: this.tokenIssuer,\n        clientId: params.clientId,\n      });\n\n    return {\n      accessToken,\n      tokenType: 'Bearer',\n      expiresIn: 3600,\n      refreshToken,\n    };\n  }\n\n  /**\n   * Verifies client credentials against the registered OIDC clients\n   */\n  public async verifyClientCredentials(options: {\n    clientId: string;\n    clientSecret: string;\n  }): Promise<boolean> {\n    const { clientId, clientSecret } = options;\n    const client = await this.oidc.getClient({ clientId });\n    if (!client?.clientSecret) {\n      return false;\n    }\n    const expected = Buffer.from(client.clientSecret, 'utf8');\n    const provided = Buffer.from(clientSecret, 'utf8');\n    if (expected.length !== provided.length) {\n      return false;\n    }\n    return crypto.timingSafeEqual(expected, provided);\n  }\n\n  /**\n   * Revoke a refresh token if offline access is enabled\n   */\n  public async revokeRefreshToken(token: string): Promise<void> {\n    if (!this.offlineAccess) {\n      return;\n    }\n    await this.offlineAccess.revokeRefreshToken(token);\n  }\n\n  private verifyPkce(opts: {\n    codeChallenge: string;\n    codeVerifier: string;\n    method?: string;\n  }): boolean {\n    if (!opts.method || opts.method === 'plain') {\n      return opts.codeChallenge === opts.codeVerifier;\n    }\n\n    if (opts.method === 'S256') {\n      const hash = crypto\n        .createHash('sha256')\n        .update(opts.codeVerifier)\n        .digest('base64url');\n      return opts.codeChallenge === hash;\n    }\n\n    return false;\n  }\n}\n"],"names":["matcher","InputError","decodeJwt","crypto","DateTime","validateCimdUrl","fetchCimdMetadata","NotFoundError","AuthenticationError"],"mappings":";;;;;;;;;;;;;;AAmCA,SAAS,mBAAA,CACP,aACA,eAAA,EACM;AACN,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,WAAW,CAAA;AAClC,EAAA,MAAM,UAAA,GAAa,GAAG,MAAA,CAAO,QAAQ,KAAK,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,CAAA;AAEvE,EAAA,IAAI,CAAC,gBAAgB,IAAA,CAAK,CAAA,OAAA,KAAWA,yBAAQ,OAAA,CAAQ,UAAA,EAAY,OAAO,CAAC,CAAA,EAAG;AAC1E,IAAA,MAAM,IAAIC,iBAAA,CAAW,CAAA,sBAAA,EAAyB,UAAU,CAAA,CAAA,CAAG,CAAA;AAAA,EAC7D;AACF;AAEA,MAAM,cAAA,GAAiB,CAAC,WAAA,EAAa,WAAA,EAAa,OAAO,CAAA;AACzD,MAAM,0BAAA,GAA6B;AAAA,EACjC,oBAAA;AAAA,EACA,oBAAA;AAAA,EACA,oBAAA;AAAA,EACA,oBAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF,CAAA;AAOA,SAAS,kBAAA,CACP,YACA,cAAA,EACS;AACT,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,UAAU,CAAA;AAEpC,EAAA,IAAI,CAAC,cAAA,CAAe,QAAA,CAAS,SAAA,CAAU,QAAQ,CAAA,EAAG;AAChD,IAAA,OAAO,cAAA,CAAe,SAAS,UAAU,CAAA;AAAA,EAC3C;AAEA,EAAA,OAAO,cAAA,CAAe,KAAK,CAAA,UAAA,KAAc;AACvC,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,IAAI,IAAI,UAAU,CAAA;AAAA,IAC1B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,OACE,cAAA,CAAe,QAAA,CAAS,GAAA,CAAI,QAAQ,KACpC,GAAA,CAAI,QAAA,KAAa,SAAA,CAAU,QAAA,IAC3B,IAAI,QAAA,KAAa,SAAA,CAAU,QAAA,IAC3B,GAAA,CAAI,aAAa,SAAA,CAAU,QAAA;AAAA,EAE/B,CAAC,CAAA;AACH;AAEO,MAAM,WAAA,CAAY;AAAA,EACN,IAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EAET,WAAA,CACN,MACA,WAAA,EACA,OAAA,EACA,UACA,IAAA,EACA,MAAA,EACA,QACA,aAAA,EACA;AACA,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AAAA,EACvB;AAAA,EAEA,OAAO,OAAO,OAAA,EASX;AACD,IAAA,OAAO,IAAI,WAAA;AAAA,MACT,OAAA,CAAQ,IAAA;AAAA,MACR,OAAA,CAAQ,WAAA;AAAA,MACR,OAAA,CAAQ,OAAA;AAAA,MACR,OAAA,CAAQ,QAAA;AAAA,MACR,OAAA,CAAQ,IAAA;AAAA,MACR,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACV;AAAA,EACF;AAAA,EAEO,gBAAA,GAAmB;AACxB,IAAA,MAAM,UAAA,GAAa,KAAK,MAAA,CAAO,kBAAA;AAAA,MAC7B;AAAA,KACF;AACA,IAAA,MAAM,EAAE,OAAA,EAAS,WAAA,EAAY,GAAI,KAAK,aAAA,EAAc;AAEpD,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,OAAA;AAAA,MACb,cAAA,EAAgB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,SAAA,CAAA;AAAA,MAC/B,iBAAA,EAAmB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,YAAA,CAAA;AAAA,MAClC,QAAA,EAAU,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAA;AAAA,MACzB,wBAAA,EAA0B,CAAC,MAAA,EAAQ,UAAU,CAAA;AAAA,MAC7C,uBAAA,EAAyB,CAAC,QAAQ,CAAA;AAAA,MAClC,qCAAA,EAAuC;AAAA,QACrC,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,gBAAA,EAAkB;AAAA,QAChB,QAAA;AAAA,QACA,GAAI,IAAA,CAAK,aAAA,GAAgB,CAAC,gBAAgB,IAAI;AAAC,OACjD;AAAA,MACA,qCAAA,EAAuC;AAAA,QACrC,qBAAA;AAAA,QACA,oBAAA;AAAA,QACA,GAAI,WAAA,GAAc,CAAC,MAAM,IAAI;AAAC,OAChC;AAAA,MACA,gBAAA,EAAkB,CAAC,KAAA,EAAO,KAAK,CAAA;AAAA,MAC/B,qBAAA,EAAuB;AAAA,QACrB,oBAAA;AAAA,QACA,GAAI,IAAA,CAAK,aAAA,GAAgB,CAAC,eAAe,IAAI;AAAC,OAChD;AAAA,MACA,sBAAA,EAAwB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,aAAA,CAAA;AAAA,MACvC,gCAAA,EAAkC,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,MAClD,GAAI,UAAA,IAAc;AAAA,QAChB,qBAAA,EAAuB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,YAAA,CAAA;AAAA,QACtC,mBAAA,EAAqB,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,UAAA;AAAA,OACtC;AAAA,MACA,GAAI,WAAA,IAAe,EAAE,qCAAA,EAAuC,IAAA;AAAK,KACnE;AAAA,EACF;AAAA,EAEA,MAAa,cAAA,GAAiB;AAC5B,IAAA,OAAO,MAAM,IAAA,CAAK,WAAA,CAAY,cAAA,EAAe;AAAA,EAC/C;AAAA,EAEA,MAAa,WAAA,CAAY,EAAE,KAAA,EAAM,EAAsB;AACrD,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,IAAA,CAAK,aAAa,KAAA,EAAO;AAAA,MACtD,kBAAA,EAAoB;AAAA,KACrB,CAAA;AACD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,WAAA,CAAY,WAAA,EAAa,MAAM,CAAA,EAAG;AAC/C,MAAA,MAAM,IAAIA,iBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,EAAE,GAAA,EAAK,aAAA,EAAc,GAAIC,eAAU,KAAK,CAAA;AAE9C,IAAA,IAAI,OAAO,kBAAkB,QAAA,EAAU;AACrC,MAAA,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAAA,IACxE;AACA,IAAA,OAAO,MAAM,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,aAAa,CAAA;AAAA,EACtD;AAAA,EAEA,MAAa,eAAe,IAAA,EAMzB;AACD,IAAA,MAAM,iBAAA,GAAoBC,wBAAO,UAAA,EAAW;AAC5C,IAAA,MAAM,qBAAA,GAAwBA,wBAAO,UAAA,EAAW;AAEhD,IAAA,MAAM,0BAAA,GAA6B,KAAK,MAAA,CAAO,sBAAA;AAAA,MAC7C;AAAA,KACF,IAAK;AAAA,MACH,YAAA;AAAA,MACA,0BAAA;AAAA,MACA,GAAG;AAAA,KACL;AAEA,IAAA,KAAA,MAAW,WAAA,IAAe,IAAA,CAAK,YAAA,IAAgB,EAAC,EAAG;AACjD,MAAA,mBAAA,CAAoB,aAAa,0BAA0B,CAAA;AAAA,IAC7D;AAEA,IAAA,OAAO,MAAM,IAAA,CAAK,IAAA,CAAK,YAAA,CAAa;AAAA,MAClC,QAAA,EAAU,iBAAA;AAAA,MACV,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,YAAA,EAAc,qBAAA;AAAA,MACd,YAAA,EAAc,IAAA,CAAK,YAAA,IAAgB,EAAC;AAAA,MACpC,aAAA,EAAe,IAAA,CAAK,aAAA,IAAiB,CAAC,MAAM,CAAA;AAAA,MAC5C,UAAA,EAAY,IAAA,CAAK,UAAA,IAAc,CAAC,oBAAoB,CAAA;AAAA,MACpD,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH;AAAA,EAEA,MAAa,2BAA2B,IAAA,EASrC;AACD,IAAA,MAAM;AAAA,MACJ,QAAA;AAAA,MACA,WAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,aAAA;AAAA,MACA;AAAA,KACF,GAAI,IAAA;AAEJ,IAAA,IAAI,iBAAiB,MAAA,EAAQ;AAC3B,MAAA,MAAM,IAAIF,kBAAW,2CAA2C,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,cAAc,EAAE,QAAA,EAAU,aAAa,CAAA;AAEjE,IAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,aAAA,EAAe;AACzC,MAAA,MAAM,IAAIA,iBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAI,aAAA,EAAe;AACjB,MAAA,IACE,CAAC,uBACD,CAAC,CAAC,QAAQ,OAAO,CAAA,CAAE,QAAA,CAAS,mBAAmB,CAAA,EAC/C;AACA,QAAA,MAAM,IAAIA,kBAAW,+BAA+B,CAAA;AAAA,MACtD;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GAAYE,wBAAO,UAAA,EAAW;AACpC,IAAA,MAAM,gBAAA,GAAmBC,cAAA,CAAS,GAAA,EAAI,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,EAAG,CAAA,CAAE,QAAA,EAAS;AAEpE,IAAA,MAAM,IAAA,CAAK,KAAK,0BAAA,CAA2B;AAAA,MACzC,EAAA,EAAI,SAAA;AAAA,MACJ,QAAA;AAAA,MACA,WAAA;AAAA,MACA,YAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,aAAA;AAAA,MACA,mBAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,SAAA;AAAA,MACJ,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,KAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEQ,aAAA,GAAgB;AACtB,IAAA,MAAM,OAAA,GACJ,KAAK,MAAA,CAAO,kBAAA;AAAA,MACV;AAAA,KACF,IAAK,KAAA;AAEP,IAAA,MAAM,WAAA,GAAc,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,kCAAA,CAAA;AAEnC,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,uBAAA,EAAyB,KAAK,MAAA,CAAO,sBAAA;AAAA,QACnC;AAAA,OACF,IAAK,CAAC,qBAAA,EAAuB,sBAAA,EAAwB,WAAW,CAAA;AAAA,MAChE,0BAAA,EACE,KAAK,MAAA,CAAO,sBAAA;AAAA,QACV;AAAA,OACF,IAAK;AAAA,KACT;AAAA,EACF;AAAA,EAEA,MAAc,cAAc,IAAA,EAGzB;AACD,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAUC,0BAAA,CAAgB,KAAK,QAAQ,CAAA;AAAA,IACzC,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,OAAO,KAAK,iBAAA,CAAkB,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAAA,IACpD;AACA,IAAA,OAAO,IAAA,CAAK,iBAAiB,IAAI,CAAA;AAAA,EACnC;AAAA,EAEA,MAAc,kBAAkB,IAAA,EAI7B;AACD,IAAA,MAAM,IAAA,GAAO,KAAK,aAAA,EAAc;AAEhC,IAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,MAAA,MAAM,IAAIJ,kBAAW,0CAA0C,CAAA;AAAA,IACjE;AAEA,IAAA,IACE,CAAC,KAAK,uBAAA,CAAwB,IAAA;AAAA,MAAK,CAAA,OAAA,KACjCD,wBAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,UAAU,OAAO;AAAA,KACxC,EACA;AACA,MAAA,MAAM,IAAIC,iBAAA,CAAW,CAAA,mBAAA,EAAsB,IAAA,CAAK,QAAQ,CAAA,CAAA,CAAG,CAAA;AAAA,IAC7D;AAEA,IAAA,MAAM,UAAA,GAAa,MAAMK,4BAAA,CAAkB;AAAA,MACzC,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,cAAc,IAAA,CAAK;AAAA,KACpB,CAAA;AAED,IAAA,IAAI,KAAK,WAAA,EAAa;AACpB,MAAA,mBAAA,CAAoB,IAAA,CAAK,WAAA,EAAa,IAAA,CAAK,0BAA0B,CAAA;AAErE,MAAA,IAAI,CAAC,kBAAA,CAAmB,IAAA,CAAK,WAAA,EAAa,UAAA,CAAW,YAAY,CAAA,EAAG;AAClE,QAAA,MAAM,IAAIL,iBAAA;AAAA,UACR,CAAA,sBAAA,EAAyB,KAAK,WAAW,CAAA,oCAAA;AAAA,SAC3C;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,YAAY,UAAA,CAAW,UAAA;AAAA,MACvB,cAAc,UAAA,CAAW,YAAA;AAAA,MACzB,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,MAAc,iBAAiB,IAAA,EAG5B;AACD,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,UAAU,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAU,CAAA;AACpE,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAIA,kBAAW,mBAAmB,CAAA;AAAA,IAC1C;AAEA,IAAA,IAAI,IAAA,CAAK,eAAe,CAAC,MAAA,CAAO,aAAa,QAAA,CAAS,IAAA,CAAK,WAAW,CAAA,EAAG;AACvE,MAAA,MAAM,IAAIA,iBAAA,CAAW,CAAA,sBAAA,EAAyB,IAAA,CAAK,WAAW,CAAA,CAAA,CAAG,CAAA;AAAA,IACnE;AAEA,IAAA,OAAO;AAAA,MACL,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,cAAc,MAAA,CAAO,YAAA;AAAA,MACrB,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AAAA,EAEA,MAAc,uBAAuB,SAAA,EAAmB;AACtD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,wBAAwB,EAAE,EAAA,EAAI,WAAW,CAAA;AAEzE,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAIM,qBAAc,+BAA+B,CAAA;AAAA,IACzD;AAEA,IAAA,IAAIH,eAAS,UAAA,CAAW,OAAA,CAAQ,SAAS,CAAA,GAAIA,cAAA,CAAS,KAAI,EAAG;AAC3D,MAAA,MAAM,IAAIH,kBAAW,+BAA+B,CAAA;AAAA,IACtD;AAEA,IAAA,IAAI,OAAA,CAAQ,WAAW,SAAA,EAAW;AAChC,MAAA,MAAM,IAAIM,qBAAc,4CAA4C,CAAA;AAAA,IACtE;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAa,4BAA4B,IAAA,EAGtC;AACD,IAAA,MAAM,EAAE,SAAA,EAAW,aAAA,EAAc,GAAI,IAAA;AACrC,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,sBAAA,CAAuB,SAAS,CAAA;AAE3D,IAAA,MAAM,IAAA,CAAK,KAAK,0BAAA,CAA2B;AAAA,MACzC,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,aAAA;AAAA,MACA,MAAA,EAAQ;AAAA,KACT,CAAA;AAED,IAAA,MAAM,oBAAoBJ,uBAAA,CAAO,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACrE,IAAA,MAAM,aAAA,GAAgBC,cAAA,CAAS,GAAA,EAAI,CAAE,IAAA,CAAK,EAAE,OAAA,EAAS,EAAA,EAAI,CAAA,CAAE,QAAA,EAAS;AAEpE,IAAA,MAAM,IAAA,CAAK,KAAK,uBAAA,CAAwB;AAAA,MACtC,IAAA,EAAM,iBAAA;AAAA,MACN,WAAW,OAAA,CAAQ,EAAA;AAAA,MACnB,SAAA,EAAW;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAW,CAAA;AAE/C,IAAA,WAAA,CAAY,YAAA,CAAa,MAAA,CAAO,MAAA,EAAQ,iBAAiB,CAAA;AACzD,IAAA,IAAI,QAAQ,KAAA,EAAO;AACjB,MAAA,WAAA,CAAY,YAAA,CAAa,MAAA,CAAO,OAAA,EAAS,OAAA,CAAQ,KAAK,CAAA;AAAA,IACxD;AAEA,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,YAAY,QAAA;AAAS,KACpC;AAAA,EACF;AAAA,EAEA,MAAa,wBAAwB,IAAA,EAA6B;AAChE,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,sBAAA,CAAuB,KAAK,SAAS,CAAA;AAChE,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,KAAK,aAAA,CAAc;AAAA,MAC9C,UAAU,OAAA,CAAQ;AAAA,KACnB,CAAA;AAED,IAAA,OAAO;AAAA,MACL,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,UAAA;AAAA,MACA,aAAa,OAAA,CAAQ,WAAA;AAAA,MACrB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,cAAc,OAAA,CAAQ,YAAA;AAAA,MACtB,eAAe,OAAA,CAAQ,aAAA;AAAA,MACvB,qBAAqB,OAAA,CAAQ,mBAAA;AAAA,MAC7B,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,QAAQ,OAAA,CAAQ;AAAA,KAClB;AAAA,EACF;AAAA,EAEA,MAAa,2BAA2B,IAAA,EAGrC;AACD,IAAA,MAAM,EAAE,SAAA,EAAW,aAAA,EAAc,GAAI,IAAA;AACrC,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,sBAAA,CAAuB,SAAS,CAAA;AAE3D,IAAA,MAAM,IAAA,CAAK,KAAK,0BAAA,CAA2B;AAAA,MACzC,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,MAAA,EAAQ,UAAA;AAAA,MACR;AAAA,KACD,CAAA;AAAA,EACH;AAAA,EAEA,MAAa,qBAAqB,MAAA,EAK/B;AACD,IAAA,MAAM,EAAE,IAAA,EAAM,WAAA,EAAa,YAAA,EAAc,WAAU,GAAI,MAAA;AAEvD,IAAA,IAAI,cAAc,oBAAA,EAAsB;AACtC,MAAA,MAAM,IAAIH,kBAAW,wBAAwB,CAAA;AAAA,IAC/C;AAEA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,KAAK,oBAAA,CAAqB,EAAE,MAAM,CAAA;AAC9D,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAIO,2BAAoB,4BAA4B,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAIJ,eAAS,UAAA,CAAW,QAAA,CAAS,SAAS,CAAA,GAAIA,cAAA,CAAS,KAAI,EAAG;AAC5D,MAAA,MAAM,IAAII,2BAAoB,4BAA4B,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,MAAM,IAAIA,2BAAoB,iCAAiC,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,uBAAA,CAAwB;AAAA,MACtD,IAAI,QAAA,CAAS;AAAA,KACd,CAAA;AAED,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAID,qBAAc,+BAA+B,CAAA;AAAA,IACzD;AAEA,IAAA,IAAI,OAAA,CAAQ,gBAAgB,WAAA,EAAa;AACvC,MAAA,MAAM,IAAIC,2BAAoB,uBAAuB,CAAA;AAAA,IACvD;AAEA,IAAA,IAAI,OAAA,CAAQ,WAAW,UAAA,EAAY;AACjC,MAAA,MAAM,IAAIA,2BAAoB,4BAA4B,CAAA;AAAA,IAC5D;AAEA,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AAC1B,MAAA,MAAM,IAAIA,2BAAoB,uCAAuC,CAAA;AAAA,IACvE;AAEA,IAAA,IAAI,QAAQ,aAAA,EAAe;AACzB,MAAA,IAAI,CAAC,YAAA,EAAc;AACjB,QAAA,MAAM,IAAIA,2BAAoB,iCAAiC,CAAA;AAAA,MACjE;AAEA,MAAA,IACE,CAAC,KAAK,UAAA,CAAW;AAAA,QACf,eAAe,OAAA,CAAQ,aAAA;AAAA,QACvB,YAAA;AAAA,QACA,QAAQ,OAAA,CAAQ;AAAA,OACjB,CAAA,EACD;AACA,QAAA,MAAM,IAAIA,2BAAoB,uBAAuB,CAAA;AAAA,MACvD;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,CAAK,KAAK,uBAAA,CAAwB;AAAA,MACtC,IAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,IAAA,CAAK,YAAY,UAAA,CAAW;AAAA,MAClD,MAAA,EAAQ;AAAA,QACN,KAAK,OAAA,CAAQ;AAAA;AACf,KACD,CAAA;AAGD,IAAA,IAAI,YAAA;AACJ,IAAA,MAAM,SAAS,OAAA,CAAQ,KAAA,EAAO,KAAA,CAAM,GAAG,KAAK,EAAC;AAC7C,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,gBAAgB,CAAA,IAAK,KAAK,aAAA,EAAe;AAC3D,MAAA,IAAI;AACF,QAAA,YAAA,GAAe,MAAM,IAAA,CAAK,aAAA,CAAc,iBAAA,CAAkB;AAAA,UACxD,eAAe,OAAA,CAAQ,aAAA;AAAA,UACvB,cAAc,OAAA,CAAQ;AAAA,SACvB,CAAA;AAAA,MACH,SAAS,GAAA,EAAK;AAGZ,QAAA,IAAA,CAAK,MAAA,CAAO,IAAA;AAAA,UACV,CAAA,uCAAA,EAA0C,OAAA,CAAQ,aAAa,CAAA,wCAAA,EAA2C,GAAG,CAAA;AAAA,SAC/G;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO;AAAA,MACL,WAAA,EAAa,KAAA;AAAA,MACb,SAAA,EAAW,QAAA;AAAA,MACX,SAAA,EAAW,IAAA;AAAA,MACX,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO,QAAQ,KAAA,IAAS,QAAA;AAAA,MACxB;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAa,mBAAmB,MAAA,EAQ7B;AACD,IAAA,IAAI,CAAC,KAAK,aAAA,EAAe;AACvB,MAAA,MAAM,IAAIP,kBAAW,gCAAgC,CAAA;AAAA,IACvD;AAEA,IAAA,MAAM,EAAE,WAAA,EAAa,YAAA,KACnB,MAAM,IAAA,CAAK,cAAc,kBAAA,CAAmB;AAAA,MAC1C,cAAc,MAAA,CAAO,YAAA;AAAA,MACrB,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,UAAU,MAAA,CAAO;AAAA,KAClB,CAAA;AAEH,IAAA,OAAO;AAAA,MACL,WAAA;AAAA,MACA,SAAA,EAAW,QAAA;AAAA,MACX,SAAA,EAAW,IAAA;AAAA,MACX;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,wBAAwB,OAAA,EAGhB;AACnB,IAAA,MAAM,EAAE,QAAA,EAAU,YAAA,EAAa,GAAI,OAAA;AACnC,IAAA,MAAM,SAAS,MAAM,IAAA,CAAK,KAAK,SAAA,CAAU,EAAE,UAAU,CAAA;AACrD,IAAA,IAAI,CAAC,QAAQ,YAAA,EAAc;AACzB,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,cAAc,MAAM,CAAA;AACxD,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,YAAA,EAAc,MAAM,CAAA;AACjD,IAAA,IAAI,QAAA,CAAS,MAAA,KAAW,QAAA,CAAS,MAAA,EAAQ;AACvC,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,OAAOE,uBAAA,CAAO,eAAA,CAAgB,QAAA,EAAU,QAAQ,CAAA;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,mBAAmB,KAAA,EAA8B;AAC5D,IAAA,IAAI,CAAC,KAAK,aAAA,EAAe;AACvB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,aAAA,CAAc,kBAAA,CAAmB,KAAK,CAAA;AAAA,EACnD;AAAA,EAEQ,WAAW,IAAA,EAIP;AACV,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,IAAU,IAAA,CAAK,WAAW,OAAA,EAAS;AAC3C,MAAA,OAAO,IAAA,CAAK,kBAAkB,IAAA,CAAK,YAAA;AAAA,IACrC;AAEA,IAAA,IAAI,IAAA,CAAK,WAAW,MAAA,EAAQ;AAC1B,MAAA,MAAM,IAAA,GAAOA,uBAAA,CACV,UAAA,CAAW,QAAQ,CAAA,CACnB,OAAO,IAAA,CAAK,YAAY,CAAA,CACxB,MAAA,CAAO,WAAW,CAAA;AACrB,MAAA,OAAO,KAAK,aAAA,KAAkB,IAAA;AAAA,IAChC;AAEA,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/plugin-auth-backend",
-  "version": "0.28.1-next.2",
+  "version": "0.29.1-next.0",
   "description": "A Backstage backend plugin that handles authentication",
   "backstage": {
     "role": "backend-plugin",
@@ -47,12 +47,12 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "1.9.1-next.1",
-    "@backstage/catalog-model": "1.8.1-next.1",
-    "@backstage/config": "1.3.8-next.0",
-    "@backstage/errors": "1.3.1-next.0",
-    "@backstage/plugin-auth-node": "0.7.1-next.1",
-    "@backstage/plugin-catalog-node": "2.2.1-next.1",
+    "@backstage/backend-plugin-api": "1.9.2-next.0",
+    "@backstage/catalog-model": "1.9.0",
+    "@backstage/config": "1.3.8",
+    "@backstage/errors": "1.3.1",
+    "@backstage/plugin-auth-node": "0.7.2-next.0",
+    "@backstage/plugin-catalog-node": "2.2.2-next.0",
     "@backstage/types": "1.2.2",
     "@google-cloud/firestore": "^7.0.0",
     "connect-session-knex": "^4.0.0",
@@ -72,11 +72,11 @@
     "zod-validation-error": "^5.0.0"
   },
   "devDependencies": {
-    "@backstage/backend-defaults": "0.17.1-next.2",
-    "@backstage/backend-test-utils": "1.11.3-next.2",
-    "@backstage/cli": "0.36.2-next.1",
-    "@backstage/plugin-auth-backend-module-google-provider": "0.3.15-next.0",
-    "@backstage/plugin-auth-backend-module-guest-provider": "0.2.19-next.0",
+    "@backstage/backend-defaults": "0.17.2-next.0",
+    "@backstage/backend-test-utils": "1.11.4-next.0",
+    "@backstage/cli": "0.36.3-next.0",
+    "@backstage/plugin-auth-backend-module-google-provider": "0.3.16-next.0",
+    "@backstage/plugin-auth-backend-module-guest-provider": "0.2.20-next.0",
     "@types/cookie-parser": "^1.4.2",
     "@types/express": "^4.17.6",
     "@types/express-session": "^1.17.2",